GitHub Advisoryadvisory · NuGet
GHSA-p9wx-v264-q34p Improper Certificate Validation in Microsoft .NET Framework components
MEDIUM
Official page ↗
- Aliases
- CVE-2018-8356
- Ecosystem
- NuGet
- Packages
- System.Private.ServiceModel, System.ServiceModel.Duplex, System.ServiceModel.Http, System.ServiceModel.NetTcp, System.ServiceModel.Primitives, System.ServiceModel.Security
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-295
- Reviewed
- 2022-07-08
Affected packages
• NuGet System.Private.ServiceModel: >= 4.0.0, < 4.1.3 → fixed in 4.1.3
• NuGet System.Private.ServiceModel: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• NuGet System.Private.ServiceModel: >= 4.4.0, < 4.4.4 → fixed in 4.4.4
• NuGet System.Private.ServiceModel: >= 4.5.0, < 4.5.3 → fixed in 4.5.3
• NuGet System.ServiceModel.Duplex: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• NuGet System.ServiceModel.Duplex: >= 4.4.0, < 4.4.4 → fixed in 4.4.4
• NuGet System.ServiceModel.Duplex: >= 4.5.0, < 4.5.3 → fixed in 4.5.3
• NuGet System.ServiceModel.Duplex: >= 4.0.0, < 4.0.4 → fixed in 4.0.4
• NuGet System.ServiceModel.Http: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• NuGet System.ServiceModel.Http: >= 4.4.0, < 4.4.4 → fixed in 4.4.4
• NuGet System.ServiceModel.Http: >= 4.5.0, < 4.5.3 → fixed in 4.5.3
• NuGet System.ServiceModel.Http: >= 4.0.0, < 4.1.3 → fixed in 4.1.3
• NuGet System.ServiceModel.NetTcp: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• NuGet System.ServiceModel.NetTcp: >= 4.4.0, < 4.4.4 → fixed in 4.4.4
• NuGet System.ServiceModel.NetTcp: >= 4.5.0, < 4.5.3 → fixed in 4.5.3
• NuGet System.ServiceModel.NetTcp: >= 4.0.0, < 4.1.3 → fixed in 4.1.3
• NuGet System.ServiceModel.Primitives: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• NuGet System.ServiceModel.Primitives: >= 4.4.0, < 4.4.4 → fixed in 4.4.4
• NuGet System.ServiceModel.Primitives: >= 4.5.0, < 4.5.3 → fixed in 4.5.3
• NuGet System.ServiceModel.Primitives: >= 4.0.0, < 4.1.3 → fixed in 4.1.3
• NuGet System.ServiceModel.Security: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• NuGet System.ServiceModel.Security: >= 4.4.0, < 4.4.4 → fixed in 4.4.4
• NuGet System.ServiceModel.Security: >= 4.5.0, < 4.5.3 → fixed in 4.5.3
• NuGet System.ServiceModel.Security: >= 4.0.0, < 4.0.4 → fixed in 4.0.4
Description
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.
Related
Alias · CVE (1)
- CVE-2018-8356 A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET… vulnerability
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness