GitHub Advisoryadvisory · NuGet
GHSA-rqrc-8q8f-cp9c Infinite loop in .Net Bond
HIGH
Official page ↗
- Aliases
- CVE-2020-1469
- Ecosystem
- NuGet
- Packages
- Bond.Core.CSharp
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-434, CWE-835
- Reviewed
- 2022-04-08
Affected packages
• NuGet Bond.Core.CSharp: >= 3.0.0, < 9.0.1 → fixed in 9.0.1
Description
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads.
Related
Alias · CVE (1)
- CVE-2020-1469 A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1469 advisory
- https://github.com/microsoft/bond/commit/3afea822c42dd0095fedb9e7db9ebb99165e7343 web
- https://github.com/microsoft/bond/commit/b0fd4a15a7cae946dd2855122559ca59cc34dbea web
- https://github.com/microsoft/bond web
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1469 web
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1469 web
- https://www.nuget.org/packages/Bond.Core.CSharp/9.0.1 web