GHSA-3m2r-q8x3-xmf7

Source

https://github.com/advisories/GHSA-3m2r-q8x3-xmf7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-3m2r-q8x3-xmf7/GHSA-3m2r-q8x3-xmf7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3m2r-q8x3-xmf7

Published

2018-10-16T19:59:48Z

Modified

2024-12-02T05:42:57.845950Z

Summary

Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

Details

Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:55:28Z"
}

References

Affected packages

NuGet / Microsoft.AspNetCore.Server.Kestrel.Core

Package

Name: Microsoft.AspNetCore.Server.Kestrel.Core; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.3

Affected versions

2.*

2.0.0

2.0.1

2.0.2

NuGet / Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions

Package

Name: Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.3

Affected versions

2.*

2.0.0

2.0.1

2.0.2

NuGet / Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

Package

Name: Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.3

Affected versions

2.*

2.0.0

2.0.1

2.0.2

NuGet / Microsoft.AspNetCore.All

Package

Name: Microsoft.AspNetCore.All; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.AspNetCore.All

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.8

Affected versions

2.*

2.0.0

2.0.3

2.0.5

2.0.6

2.0.7