GHSA-655q-9gvg-q4cm
Remote code execution in ASP.NET Core
At a glance
- Published
- Updated
- CVE
- CVE-2020-0603
- Aliases
- BIT-aspnet-core-2020-0603
Description
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.AspNetCore.All | introduced 2.1.0, fixed 2.1.15 |
| NuGet · Microsoft.AspNetCore.App | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App | introduced 3.0.0, fixed 3.0.1 |
| NuGet · Microsoft.AspNetCore.App | introduced 2.1.0, fixed 2.1.15 |
| NuGet · Microsoft.AspNetCore.Http.Connections | introduced 1.0.0, fixed 1.0.15 |
| NuGet · Microsoft.AspNetCore.App.Runtime.linux-arm | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.linux-arm64 | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.linux-x64 | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.osx-x64 | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.win-arm | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.win-x64 | introduced 3.1.0, fixed 3.1.1 |
| NuGet · Microsoft.AspNetCore.App.Runtime.win-x86 | introduced 3.1.0, fixed 3.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-0603 ADVISORY
- https://github.com/aspnet/Announcements/issues/403 WEB
- https://github.com/github/advisory-database/issues/302 WEB
- https://access.redhat.com/errata/RHSA-2020:0130 WEB
- https://access.redhat.com/errata/RHSA-2020:0134 WEB
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |