GHSA-jc8g-xhw5-6x46
Improper Certificate Validation in Microsoft .NET Framework components
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2018-0786
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
Paquets affectés
| Paquet | Versions |
|---|---|
| NuGet · Microsoft.NETCore.UniversalWindowsPlatform | introduced 5.2.0, fixed 5.2.4 |
| NuGet · Microsoft.NETCore.UniversalWindowsPlatform | introduced 5.3.0, fixed 5.3.5 |
| NuGet · Microsoft.NETCore.UniversalWindowsPlatform | introduced 5.4.0, fixed 5.4.2 |
| NuGet · Microsoft.NETCore.UniversalWindowsPlatform | introduced 6.0.0, fixed 6.0.6 |
| NuGet · System.ServiceModel.Primitives | introduced 4.4.0, fixed 4.4.1 |
| NuGet · System.ServiceModel.Primitives | introduced 4.3.0, fixed 4.3.1 |
| NuGet · System.ServiceModel.Primitives | introduced 4.1.0, fixed 4.1.1 |
| NuGet · System.ServiceModel.Http | introduced 4.4.0, fixed 4.4.1 |
| NuGet · System.ServiceModel.Http | introduced 4.3.0, fixed 4.3.1 |
| NuGet · System.ServiceModel.Http | introduced 4.1.0, fixed 4.1.1 |
| NuGet · System.ServiceModel.NetTcp | introduced 4.4.0, fixed 4.4.1 |
| NuGet · System.ServiceModel.NetTcp | introduced 4.3.0, fixed 4.3.1 |
| NuGet · System.ServiceModel.NetTcp | introduced 4.1.0, fixed 4.1.1 |
| NuGet · System.ServiceModel.Duplex | introduced 4.4.0, fixed 4.4.1 |
| NuGet · System.ServiceModel.Duplex | introduced 4.3.0, fixed 4.3.1 |
| NuGet · System.ServiceModel.Duplex | introduced 4.0.1, fixed 4.0.2 |
| NuGet · System.ServiceModel.Security | introduced 4.4.0, fixed 4.4.1 |
| NuGet · System.ServiceModel.Security | introduced 4.3.0, fixed 4.3.1 |
| NuGet · System.ServiceModel.Security | introduced 4.0.1, fixed 4.0.2 |
| NuGet · System.Private.ServiceModel | introduced 4.4.0, fixed 4.4.1 |
| NuGet · System.Private.ServiceModel | introduced 4.3.0, fixed 4.3.1 |
| NuGet · System.Private.ServiceModel | introduced 4.1.0, fixed 4.1.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2018-0786 ADVISORY
- https://github.com/dotnet/announcements/issues/51 WEB
- https://github.com/github/advisory-database/issues/302 WEB
- https://github.com/advisories/GHSA-jc8g-xhw5-6x46 ADVISORY
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786 WEB
- https://www.nuget.org/packages/System.ServiceModel.Duplex#versions-body-tab WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |