CVE-2020-1108: .NET Core & .NET Framework Denial of Service Vulnerability
Summary
CVE-2020-1108: .NET Core & .NET Framework Denial of Service Vulnerability. Affects Microsoft.NETCore.App versions >= 2.1.0, < 2.1.18. Fixed in 2.1.18. How to fix ↓
Also tracked for
- powershell · Bitnami
- dotnet · Bitnami
- dotnet-sdk · Bitnami
The same CVE-2020-1108 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Microsoft.NETCore.App package is a NuGet package that provides the runtime components necessary to run .NET Core applications. It is a cross-platform framework that allows developers to build and deploy applications on Windows, macOS, and Linux. The package is widely used in various software applications and is a critical component of the .NET ecosystem. However, it is vulnerable to a denial of service attack.
Vulnerability Detail
The vulnerability in the Microsoft.NETCore.App package allows an attacker to launch a denial of service attack by sending specially crafted web requests. The vulnerability lies in the way .NET Core and .NET Framework handle these requests, leading to improper handling and resource exhaustion. This can result in the application becoming unresponsive or crashing, causing a disruption in service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.1.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the affected package to the latest version.
Conclusion
The .NET Core & .NET Framework Denial of Service Vulnerability in the Microsoft.NETCore.App package can lead to a denial of service attack, causing the affected application to become unresponsive or crash. It is recommended to update the package to the latest version that includes the fix (version 2.1.18 or later). For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Microsoft.NETCore.App →
FAQ
This vulnerability can lead to a denial of service attack, causing the affected application to become unresponsive or crash. This can result in a disruption of service for users.
Versions 2.1.0 to 2.1.17 of the Microsoft.NETCore.App package are affected by this vulnerability.
There is no known exploit for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to prevent any potential attacks.
The only mitigation for this vulnerability is to update the affected package to the latest version that includes the fix.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It provides real-time monitoring and alerts for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.NETCore.App.
