GitHub Advisoryadvisory · NuGet

GHSA-f9jc-rrm2-pmfg Denial of service in ASP.NET Core

HIGH Published 2022-05-13 Modified 2022-07-08 Official page ↗
Aliases
CVE-2017-11883
Ecosystem
NuGet
Packages
Microsoft.AspNetCore.Server.WebListener, Microsoft.Net.Http.Server, Microsoft.AspNetCore.Server.HttpSys
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed
2022-07-08

Affected packages

• NuGet Microsoft.AspNetCore.Server.WebListener: >= 1.0.0, < 1.0.6 → fixed in 1.0.6 • NuGet Microsoft.AspNetCore.Server.WebListener: >= 1.1.0, < 1.1.4 → fixed in 1.1.4 • NuGet Microsoft.Net.Http.Server: >= 1.0.0, < 1.0.6 → fixed in 1.0.6 • NuGet Microsoft.Net.Http.Server: >= 1.1.0, < 1.1.4 → fixed in 1.1.4 • NuGet Microsoft.AspNetCore.Server.HttpSys: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".

Related

Alias · CVE (1)

  • CVE-2017-11883 .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web… vulnerability

References