QID 982023

QID 982023: Dotnet (nuget) Security Update for System.Net.Http.WinHttpHandler (GHSA-6xh7-4v2w-36q6)

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-6xh7-4v2w-36q6 for updates pertaining to this vulnerability.

Vendor References

GHSA-6xh7-4v2w-36q6 - github.com/advisories/GHSA-6xh7-4v2w-36q6

CVEs related to QID 982023

CVE-2017-0247 |

Software Advisories

Advisory ID	Software	Link
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Abstractions	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.ApiExplorer	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Core	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Cors	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.DataAnnotations	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Formatters.Json	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Formatters.Xml	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Localization	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Razor	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.Razor.Host	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.TagHelpers	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.ViewFeatures	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	Microsoft.AspNetCore.Mvc.WebApiCompatShim	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	System.Net.Http	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	System.Net.Http.WinHttpHandler	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	System.Net.Security	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	System.Net.WebSockets.Client	github.com/advisories/GHSA-6xh7-4v2w-36q6
GHSA-6xh7-4v2w-36q6	System.Text.Encodings.Web	github.com/advisories/GHSA-6xh7-4v2w-36q6

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].