QID 982827

QID 982827: Dotnet (nuget) Security Update for Microsoft.AspNetCore.Mvc.WebApiCompatShim (GHSA-ch6p-4jcm-h8vh)

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-ch6p-4jcm-h8vh for updates pertaining to this vulnerability.

Vendor References

GHSA-ch6p-4jcm-h8vh - github.com/advisories/GHSA-ch6p-4jcm-h8vh

CVEs related to QID 982827

CVE-2017-0248 |

Software Advisories

Advisory ID	Software	Link
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Abstractions	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.ApiExplorer	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Core	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Cors	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.DataAnnotations	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Formatters.Json	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Formatters.Xml	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Localization	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Razor	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.Razor.Host	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.TagHelpers	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.ViewFeatures	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	Microsoft.AspNetCore.Mvc.WebApiCompatShim	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	System.Net.Http	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	System.Net.Http.WinHttpHandler	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	System.Net.Security	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	System.Net.WebSockets.Client	github.com/advisories/GHSA-ch6p-4jcm-h8vh
GHSA-ch6p-4jcm-h8vh	System.Text.Encodings.Web	github.com/advisories/GHSA-ch6p-4jcm-h8vh

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].