Microsoft NuGet Package Manager CVE-2019-0757 Tampering Security Bypass Vulnerability

Bugtraq ID:	107285
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2019-0757
Remote:	No
Local:	Yes
Published:	Mar 12 2019 12:00AM
Updated:	Mar 13 2019 09:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Mono-Project Mono 5.20 Mono-Project Mono 5.18.0.223 Microsoft Visual Studio for Mac 0 Microsoft NuGet 4.9.4 Microsoft NuGet 4.8.2 Microsoft NuGet 4.7.2 Microsoft NuGet 4.6.3 Microsoft NuGet 4.5.2 Microsoft NuGet 4.4.2 Microsoft NuGet 4.3.1 Microsoft .NET Core SDK 2.1.500 Microsoft .NET Core SDK 1.1 Microsoft .NET Core 2.1 Microsoft .NET Core 1.1 Microsoft .NET Core 1.0
Not Vulnerable:	Microsoft .NET Core SDK 2.1.505 Microsoft .NET Core SDK 1.1.13 Microsoft .NET Core 2.1.9 Microsoft .NET Core 1.1.12 Microsoft .NET Core 1.0.15

Microsoft NuGet Package Manager CVE-2019-0757 Tampering Security Bypass Vulnerability

Microsoft NuGet is prone to a security bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Microsoft NuGet Package Manager CVE-2019-0757 Tampering Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft NuGet Package Manager CVE-2019-0757 Tampering Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Microsoft NuGet Package Manager CVE-2019-0757 Tampering Security Bypass Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Bug 1685475 CVE-2019-0757 dotnet: NuGet Tampering Vulnerability (Redhat)
  
• CVE-2019-0757 (Redhat)
  
• CVE-2019-0757 | NuGet Package Manager Tampering Vulnerability (Microsoft)