CVE-2019-0981: Denial of Service in System.Private.Uri
Summary
CVE-2019-0981: Denial of service in ASP.NET Core. Affects System.Private.Uri versions >= 4.3.0, < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
System.Private.Uri is a NuGet package that provides functionality for working with URIs in .NET Framework and .NET Core. It is used to parse, manipulate, and validate URIs in applications. However, a vulnerability has been discovered in this package that can lead to a denial of service attack.
Vulnerability Detail
The vulnerability exists due to improper handling of web requests in .NET Framework and .NET Core. Attackers can exploit this vulnerability to send specially crafted web requests that can cause the application to become unresponsive or crash. This can result in a denial of service, impacting the availability of the affected application. The vulnerability is assigned a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
4.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the System.Private.Uri package.
Conclusion
The System.Private.Uri package is vulnerable to a denial of service attack. To protect your application, it is crucial to update the package to version 4.3.2 or later. Vulert Playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for System.Private.Uri →
FAQ
The vulnerability can lead to a denial of service attack, causing the affected application to become unresponsive or crash.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your packages.config file and Vulert will analyze it for any open-source vulnerabilities, including this one.
While there is no known public exploit for this vulnerability, it is still important to apply the fix to prevent potential attacks.
No, the only way to mitigate the risk is to update the System.Private.Uri package to the fixed version.
In addition to updating the package, it is always recommended to follow secure coding practices and implement proper input validation to mitigate the risk of similar vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for System.Private.Uri.
