GitHub Advisoryadvisory · NuGet

GHSA-6px8-22w5-w334 Denial of service in ASP.NET Core

HIGH Published 2022-05-14 Modified 2022-07-08 Official page ↗
Aliases
CVE-2019-0564
Ecosystem
NuGet
Packages
Microsoft.AspNetCore.WebSockets, Microsoft.AspNetCore.Server.Kestrel.Core, System.Net.WebSockets.WebSocketProtocol, Microsoft.NETCore.App, Microsoft.AspNetCore.App, Microsoft.AspNetCore.All
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed
2022-07-08

Affected packages

• NuGet Microsoft.AspNetCore.WebSockets: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • NuGet Microsoft.AspNetCore.WebSockets: >= 2.1.0, < 2.1.7 → fixed in 2.1.7 • NuGet Microsoft.AspNetCore.Server.Kestrel.Core: >= 2.1.0, < 2.1.7 → fixed in 2.1.7 • NuGet System.Net.WebSockets.WebSocketProtocol: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet Microsoft.NETCore.App: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • NuGet Microsoft.NETCore.App: >= 2.1.0, < 2.1.7 → fixed in 2.1.7 • NuGet Microsoft.AspNetCore.App: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • NuGet Microsoft.AspNetCore.App: >= 2.1.0, < 2.1.7 → fixed in 2.1.7 • NuGet Microsoft.AspNetCore.All: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • NuGet Microsoft.AspNetCore.All: >= 2.1.0, < 2.1.7 → fixed in 2.1.7

Description

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

Related

Alias · CVE (1)

  • CVE-2019-0564 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service… vulnerability

References