CVE-2019-0980: Denial of service in ASP.NET Core
Summary
CVE-2019-0980: Denial of service in ASP.NET Core. Affects System.Private.Uri versions >= 4.3.0, < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The System.Private.Uri package is a NuGet package that is part of the .NET Framework and .NET Core. It provides functionality for handling URIs (Uniform Resource Identifiers) in .NET applications. URIs are used to identify and locate resources on the internet or within a local network. The System.Private.Uri package is widely used in ASP.NET Core applications for handling and processing web requests.
Vulnerability Detail
A denial of service vulnerability has been identified in the System.Private.Uri package. This vulnerability arises from improper handling of web requests in the .NET Framework and .NET Core. An attacker can exploit this vulnerability by sending specially crafted web requests to a vulnerable application. The vulnerability can lead to a denial of service, causing the application to become unresponsive or crash. The impact of this vulnerability can be severe, as it can disrupt the availability and functionality of affected applications.
How To Fix
Minimum fixed version
4.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the System.Private.Uri package to the latest version.
Conclusion
The System.Private.Uri package in ASP.NET Core is vulnerable to a denial of service attack. It is crucial to update the package to version 4.3.2 or later to mitigate this vulnerability. No known workaround exists, and it is recommended to apply the fix as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for System.Private.Uri →
FAQ
This vulnerability can lead to a denial of service, causing affected applications to become unresponsive or crash.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your packages.config file and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is crucial to update the System.Private.Uri package to the latest version.
You can update the System.Private.Uri package by modifying the project's dependencies in the project file or using the NuGet package manager in Visual Studio. Simply update the package version to 4.3.2 or later.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xhfc-gr8f-ffwc/GHSA-xhfc-gr8f-ffwc.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for System.Private.Uri.
