GHSA-6px8-22w5-w334
Denial of service in ASP.NET Core
At a glance
- Published
- Updated
- CVE
- CVE-2019-0564
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.AspNetCore.WebSockets | introduced 2.2.0, fixed 2.2.1 |
| NuGet · Microsoft.AspNetCore.WebSockets | introduced 2.1.0, fixed 2.1.7 |
| NuGet · Microsoft.AspNetCore.Server.Kestrel.Core | introduced 2.1.0, fixed 2.1.7 |
| NuGet · System.Net.WebSockets.WebSocketProtocol | introduced 4.5.0, fixed 4.5.3 |
| NuGet · Microsoft.NETCore.App | introduced 2.2.0, fixed 2.2.1 |
| NuGet · Microsoft.NETCore.App | introduced 2.1.0, fixed 2.1.7 |
| NuGet · Microsoft.AspNetCore.App | introduced 2.2.0, fixed 2.2.1 |
| NuGet · Microsoft.AspNetCore.App | introduced 2.1.0, fixed 2.1.7 |
| NuGet · Microsoft.AspNetCore.All | introduced 2.2.0, fixed 2.2.1 |
| NuGet · Microsoft.AspNetCore.All | introduced 2.1.0, fixed 2.1.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-0564 ADVISORY
- https://github.com/aspnet/Announcements/issues/334 WEB
- https://github.com/github/advisory-database/issues/302 WEB
- https://access.redhat.com/errata/RHSA-2019:0040 WEB
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0564 WEB
- http://www.securityfocus.com/bid/106413 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |