Open Source Vulnerability in CoreWCF.NetFramingBase: CoreWCF NetFraming based services can leave connections open when they should be closed
Summary
CVE-2024-28252: CoreWCF NetFraming based services can leave connections open when they should be closed. Affects CoreWCF.NetFramingBase across 2 version ranges.
>= 1.4.0, < 1.4.2
>= 1.5.0, < 1.5.2
Fixed in 1.4.2 or 1.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CoreWCF.NetFramingBase is a NuGet package that provides NetFraming based services for CoreWCF. It includes bindings such as NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. These bindings allow for communication between clients and services using the NetFraming protocol. However, a vulnerability has been discovered in these bindings that can result in connections being left open when they should be closed.
Vulnerability Detail
The vulnerability occurs in two scenarios. Firstly, when a client establishes a connection to the service but sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. This can lead to the consumption of extra system resources. Secondly, if a client establishes a session but doesn't send any requests within the configured ReceiveTimeout period, the connection is not properly closed when the session is aborted. This can also result in the consumption of system resources. The affected versions of CoreWCF.NetFramingBase are 1.4.0 to 1.4.1 and 1.5.0 to 1.5.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.4.0, < 1.4.21.4.2 -
>= 1.5.0, < 1.5.21.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. Updating to the fixed versions is the recommended solution.
Conclusion
In conclusion, the CoreWCF.NetFramingBase package is vulnerable to a flaw that can result in connections being left open when they should be closed. To mitigate this vulnerability, it is recommended to update to the fixed versions of the package (1.4.2 or 1.5.2). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for CoreWCF.NetFramingBase →
FAQ
CoreWCF.NetFramingBase is a NuGet package that provides NetFraming based services for CoreWCF. It includes bindings such as NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding.
The affected versions are 1.4.0 to 1.4.1 and 1.5.0 to 1.5.1.
The vulnerability can result in the consumption of extra system resources due to connections being left open when they should be closed.
No, there are no known workarounds. Updating to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-32jq-mv89-5rx7/GHSA-32jq-mv89-5rx7.json
References
Related vulnerabilities
Recent vulnerabilities recorded for CoreWCF.NetFramingBase.
