GitHub Advisoryadvisory · NuGet

GHSA-p9wx-v264-q34p Improper Certificate Validation in Microsoft .NET Framework components

MEDIUM Published 2022-05-14 Modified 2022-07-08 Official page ↗
Aliases
CVE-2018-8356
Ecosystem
NuGet
Packages
System.Private.ServiceModel, System.ServiceModel.Duplex, System.ServiceModel.Http, System.ServiceModel.NetTcp, System.ServiceModel.Primitives, System.ServiceModel.Security
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2022-07-08

Affected packages

• NuGet System.Private.ServiceModel: >= 4.0.0, < 4.1.3 → fixed in 4.1.3 • NuGet System.Private.ServiceModel: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • NuGet System.Private.ServiceModel: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • NuGet System.Private.ServiceModel: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet System.ServiceModel.Duplex: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • NuGet System.ServiceModel.Duplex: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • NuGet System.ServiceModel.Duplex: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet System.ServiceModel.Duplex: >= 4.0.0, < 4.0.4 → fixed in 4.0.4 • NuGet System.ServiceModel.Http: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • NuGet System.ServiceModel.Http: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • NuGet System.ServiceModel.Http: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet System.ServiceModel.Http: >= 4.0.0, < 4.1.3 → fixed in 4.1.3 • NuGet System.ServiceModel.NetTcp: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • NuGet System.ServiceModel.NetTcp: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • NuGet System.ServiceModel.NetTcp: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet System.ServiceModel.NetTcp: >= 4.0.0, < 4.1.3 → fixed in 4.1.3 • NuGet System.ServiceModel.Primitives: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • NuGet System.ServiceModel.Primitives: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • NuGet System.ServiceModel.Primitives: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet System.ServiceModel.Primitives: >= 4.0.0, < 4.1.3 → fixed in 4.1.3 • NuGet System.ServiceModel.Security: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • NuGet System.ServiceModel.Security: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • NuGet System.ServiceModel.Security: >= 4.5.0, < 4.5.3 → fixed in 4.5.3 • NuGet System.ServiceModel.Security: >= 4.0.0, < 4.0.4 → fixed in 4.0.4

Description

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.

Related

Alias · CVE (1)

  • CVE-2018-8356 A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References