GHSA-jrjw-qgr2-wfcg

Source

https://github.com/advisories/GHSA-jrjw-qgr2-wfcg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-jrjw-qgr2-wfcg/GHSA-jrjw-qgr2-wfcg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jrjw-qgr2-wfcg

Aliases

CVE-2023-33141

Published

2023-06-23T21:37:26Z

Modified

2024-06-03T18:49:04.003006Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

YARP Denial of Service Vulnerability

Details

Impact

A denial of service vulnerability exists in YARP.

Patches

If you're using YARP 1.x, you should update to NuGet package version 1.1.2. If you're using YARP 2.0.0, you should update to NuGet package version 2.0.1.

You can do so by updating the PackageReference in your .csproj file

<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="2.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="2.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.1" />
</ItemGroup>

or by selecting 2.0.1 in the NuGet UI inside Visual Studio (Manage NuGet Packages / Updates)

References

CVE-2023-33141

Database specific

{
    "nvd_published_at": "2023-06-23T02:15:09Z",
    "github_reviewed_at": "2023-06-23T21:37:26Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

NuGet / Yarp.ReverseProxy

Package

Name: Yarp.ReverseProxy; View open source insights on deps.dev
Purl: pkg:nuget/Yarp.ReverseProxy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.2

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.1.1

Database specific

last_known_affected_version_range

"<= 1.1.1"

GHSA-jrjw-qgr2-wfcg

Impact

Patches

References

Affected packages

NuGet / Yarp.ReverseProxy

Package

Affected ranges

Affected versions

1.*

Database specific

last_known_affected_version_range

NuGet / Yarp.ReverseProxy

Package

Affected ranges

Affected versions

2.*