Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-1301 (GCVE-0-2019-1301)
Vulnerability from cvelistv5 – Published: 2019-09-11 21:25 – Updated: 2024-08-04 18:13
VLAI?
EPSS
Summary
A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.
Severity ?
No CVSS data available.
CWE
- Denial of Service
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:13:30.342Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": ".NET Core",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of Service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-11T21:25:01.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2019-1301",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": ".NET Core",
"version": {
"version_data": [
{
"version_value": "2.1"
},
{
"version_value": "2.2"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2019-1301",
"datePublished": "2019-09-11T21:25:01.000Z",
"dateReserved": "2018-11-26T00:00:00.000Z",
"dateUpdated": "2024-08-04T18:13:30.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
FKIE_CVE-2019-1301
Vulnerability from fkie_nvd - Published: 2019-09-11 22:15 - Updated: 2024-11-21 04:36
Severity ?
Summary
A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | .net_core | 2.1 | |
| microsoft | .net_core | 2.2 | |
| microsoft | powershell_core | 6.1 | |
| microsoft | powershell_core | 6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3BF7E3F6-D3AE-404D-8F0E-0C57BF23006C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_core:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AB75F9-B0FC-46B5-A863-0458696773DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:powershell_core:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B9A97F21-61EB-4775-9993-4F5500545198",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:powershell_core:6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A3830438-FB77-4031-B229-F6A37DDCBE98",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de denegaci\u00f3n de servicio cuando .NET Core maneja inapropiadamente las peticiones web, tambi\u00e9n se conoce como \".NET Core Denial of Service Vulnerability\"."
}
],
"id": "CVE-2019-1301",
"lastModified": "2024-11-21T04:36:26.003",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-09-11T22:15:19.023",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CERTFR-2019-AVI-570
Vulnerability from certfr_avis - Published: 2019-11-13 - Updated: 2019-11-13
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, un contournement de la fonctionnalité de sécurité, une usurpation d'identité, une exécution de code à distance, une élévation de privilèges et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | ChakraCore | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.0 | ||
| Microsoft | N/A | Team Foundation Server 2018 Update 3.2 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.2 | ||
| Microsoft | Azure | Azure DevOps Server 2019.0.1 | ||
| Microsoft | N/A | PowerShell Core 6.2 | ||
| Microsoft | N/A | SQL Server Management Studio 18.3.1 | ||
| Microsoft | Azure | Azure DevOps Server 2019 Update 1 | ||
| Microsoft | N/A | Microsoft System Center 2012 R2 Endpoint Protection | ||
| Microsoft | N/A | Yammer pour Android | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 3 | ||
| Microsoft | Azure | Azure Stack | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 | ||
| Microsoft | N/A | Microsoft System Center Endpoint Protection | ||
| Microsoft | N/A | Team Foundation Server 2017 Update 3.1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.0 | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft Security Essentials | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 2 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 13 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.3 | ||
| Microsoft | N/A | Microsoft Lync Server 2013 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2015 Update 3 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 14 | ||
| Microsoft | N/A | Team Foundation Server 2018 Update 1.2 | ||
| Microsoft | N/A | Rome SDK 1.4.1 | ||
| Microsoft | N/A | SQL Server Management Studio 18.3 | ||
| Microsoft | Azure | Azure App Service on Azure Stack | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Forefront Endpoint Protection 2010 | ||
| Microsoft | N/A | Open Enclave SDK | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 12 | ||
| Microsoft | N/A | Team Foundation Server 2015 Update 4.2 | ||
| Microsoft | N/A | PowerShell Core 6.1 | ||
| Microsoft | N/A | Microsoft System Center 2012 Endpoint Protection |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "ChakraCore",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Team Foundation Server 2018 Update 3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2019.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "PowerShell Core 6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "SQL Server Management Studio 18.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2019 Update 1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft System Center 2012 R2 Endpoint Protection",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Yammer pour Android",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Stack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft System Center Endpoint Protection",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Team Foundation Server 2017 Update 3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Security Essentials",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 13",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Lync Server 2013",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2015 Update 3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 14",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Team Foundation Server 2018 Update 1.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Rome SDK 1.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "SQL Server Management Studio 18.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure App Service on Azure Stack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Forefront Endpoint Protection 2010",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Open Enclave SDK",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Team Foundation Server 2015 Update 4.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "PowerShell Core 6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft System Center 2012 Endpoint Protection",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1375",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1375"
},
{
"name": "CVE-2019-1369",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1369"
},
{
"name": "CVE-2019-1234",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1234"
},
{
"name": "CVE-2019-1300",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1300"
},
{
"name": "CVE-2019-1266",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1266"
},
{
"name": "CVE-2019-1255",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1255"
},
{
"name": "CVE-2019-1232",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1232"
},
{
"name": "CVE-2019-1428",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1428"
},
{
"name": "CVE-2019-1306",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1306"
},
{
"name": "CVE-2019-1298",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1298"
},
{
"name": "CVE-2019-1305",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1305"
},
{
"name": "CVE-2019-1335",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1335"
},
{
"name": "CVE-2019-1231",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1231"
},
{
"name": "CVE-2019-1313",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1313"
},
{
"name": "CVE-2019-1426",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1426"
},
{
"name": "CVE-2019-1217",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1217"
},
{
"name": "CVE-2019-1307",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1307"
},
{
"name": "CVE-2019-1233",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1233"
},
{
"name": "CVE-2019-1366",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1366"
},
{
"name": "CVE-2019-1308",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1308"
},
{
"name": "CVE-2019-1372",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1372"
},
{
"name": "CVE-2019-1376",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1376"
},
{
"name": "CVE-2019-1237",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1237"
},
{
"name": "CVE-2019-1370",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1370"
},
{
"name": "CVE-2019-1301",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1301"
},
{
"name": "CVE-2019-1425",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1425"
},
{
"name": "CVE-2019-1414",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1414"
},
{
"name": "CVE-2019-1373",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1373"
},
{
"name": "CVE-2019-1427",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1427"
},
{
"name": "CVE-2019-1265",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1265"
},
{
"name": "CVE-2019-1209",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1209"
},
{
"name": "CVE-2019-1138",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1138"
}
],
"initial_release_date": "2019-11-13T00:00:00",
"last_revision_date": "2019-11-13T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-570",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, un\ncontournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9, une usurpation\nd\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, une \u00e9l\u00e9vation de\nprivil\u00e8ges et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 novembre 2019",
"url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
}
]
}
CERTFR-2019-AVI-437
Vulnerability from certfr_avis - Published: 2019-09-11 - Updated: 2019-09-11
De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un attaquant de provoquer une élévation de privilèges et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | .Net | ASP.NET Core 3.0 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.8 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 AND 4.8 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 AND 4.7.2 | ||
| Microsoft | .Net | ASP.NET Core 2.2 | ||
| Microsoft | .Net | ADAL.NET | ||
| Microsoft | N/A | Microsoft .NET Framework 4.5.2 | ||
| Microsoft | N/A | .NET Core 2.1 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | ||
| Microsoft | .Net | ASP.NET Core 2.1 | ||
| Microsoft | N/A | .NET Core 2.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ASP.NET Core 3.0",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5 AND 4.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5 AND 4.7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "ASP.NET Core 2.2",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "ADAL.NET",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.5.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": ".NET Core 2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "ASP.NET Core 2.1",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": ".NET Core 2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1302",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1302"
},
{
"name": "CVE-2019-1142",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1142"
},
{
"name": "CVE-2019-1258",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1258"
},
{
"name": "CVE-2019-1301",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1301"
}
],
"initial_release_date": "2019-09-11T00:00:00",
"last_revision_date": "2019-09-11T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-437",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-09-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft .Net\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft .Net",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 10 septembre 2019",
"url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
}
]
}
CERTFR-2019-AVI-569
Vulnerability from certfr_avis - Published: 2019-11-13 - Updated: 2019-11-13
De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un attaquant de provoquer une élévation de privilèges et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | .Net | ASP.NET Core 3.0 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.8 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 AND 4.8 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 AND 4.7.2 | ||
| Microsoft | .Net | ASP.NET Core 2.2 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.5.2 | ||
| Microsoft | N/A | .NET Core 2.1 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | ||
| Microsoft | .Net | ASP.NET Core 2.1 | ||
| Microsoft | N/A | .NET Core 2.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ASP.NET Core 3.0",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5 AND 4.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5 AND 4.7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "ASP.NET Core 2.2",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.5.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": ".NET Core 2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "ASP.NET Core 2.1",
"product": {
"name": ".Net",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": ".NET Core 2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1302",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1302"
},
{
"name": "CVE-2019-1142",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1142"
},
{
"name": "CVE-2019-1301",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1301"
}
],
"initial_release_date": "2019-11-13T00:00:00",
"last_revision_date": "2019-11-13T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-569",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft .Net\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft .Net",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 novembre 2019",
"url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
}
]
}
GSD-2019-1301
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-1301",
"description": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027.",
"id": "GSD-2019-1301",
"references": [
"https://access.redhat.com/errata/RHSA-2019:2732",
"https://access.redhat.com/errata/RHSA-2019:2731",
"https://linux.oracle.com/cve/CVE-2019-1301.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-1301"
],
"details": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027.",
"id": "GSD-2019-1301",
"modified": "2023-12-13T01:23:51.610619Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2019-1301",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": ".NET Core",
"version": {
"version_data": [
{
"version_value": "2.1"
},
{
"version_value": "2.2"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[6.2.0,6.2.3),(,6.1.6)",
"affected_versions": "All versions starting from 6.2.0 before 6.2.3, all versions before 6.1.6",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-09-01",
"description": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027.",
"fixed_versions": [
"6.1.6"
],
"identifier": "CVE-2019-1301",
"identifiers": [
"GHSA-62gw-3rmj-wmp2",
"CVE-2019-1301"
],
"not_impacted": "All versions before 6.2.0, all versions starting from 6.1.6 before 6.2.3",
"package_slug": "nuget/System.Management.Automation",
"pubdate": "2019-09-13",
"solution": "Upgrade to version 6.1.6 or above.",
"title": "High severity vulnerability that affects System.Management.Automation",
"urls": [
"https://github.com/PowerShell/PowerShell/security/advisories/GHSA-62gw-3rmj-wmp2",
"https://nvd.nist.gov/vuln/detail/CVE-2019-1301",
"https://github.com/advisories/GHSA-62gw-3rmj-wmp2"
],
"uuid": "029bb5ab-efa2-482a-92cb-079509b4874f"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:powershell_core:6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:.net_core:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:powershell_core:6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2019-1301"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A denial of service vulnerability exists when .NET Core improperly handles web requests, aka \u0027.NET Core Denial of Service Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301",
"refsource": "MISC",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2020-08-24T17:37Z",
"publishedDate": "2019-09-11T22:15Z"
}
}
}
GHSA-62GW-3RMJ-WMP2
Vulnerability from github – Published: 2019-09-13 13:25 – Updated: 2025-04-02 22:32
VLAI?
Summary
High severity vulnerability that affects System.Management.Automation
Details
Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core
Executive Summary
A denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.
The update addresses the vulnerability by correcting how the .NET Core handles web requests.
System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)
Discussion
Please open a support question to discussion the PowerShell aspects of this advisory. Please use dotnet/announcements#121 for discussion of the .NET aspects this advisory.
Affected Software
The vulnerability affects PowerShell Core prior to the following versions:
| PowerShell Core Version | Fixed in |
|---|---|
| 6.1 | 6.1.6 |
| 6.2 | 6.2.3 |
| 7.0 | unaffected |
| 5 | unaffected |
Advisory FAQ
How do I know if I am affected?
If all of the following are true:
- Run
pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected. - If you are running a version of PowerShell Core where the executable is not
pwshorpwsh.exe, then you are affected. This only existed for preview version of6.0.
How do I update to an unaffected version?
Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.
Other Information
Reporting Security Issues
If you have found a potential security issue in PowerShell Core, please email details to secure@microsoft.com.
Support
You can ask questions about this issue on GitHub in the PowerShell organization. This is located at https://github.com/PowerShell/. The Announcements repo (https://github.com/PowerShell/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.
What if the update breaks my script or module?
You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core. This should be treated as a temporary measure. Therefore, the script or module should be updated to work with the patched version of PowerShell Core.
Acknowledgments
Paul Ryman of VMware Sydney Engineering Team
Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.
See acknowledgments for more information.
External Links
Severity ?
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "System.Management.Automation"
},
"ranges": [
{
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "System.Management.Automation"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-1301"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:17:47Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=\u0026labels=Issue-Question\u0026template=Support_Question.md\u0026title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## \u003ca name=\"affected-software\"\u003eAffected Software\u003c/a\u003e\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n\n| PowerShell Core Version | Fixed in |\n|-------------------------|-------------------|\n| 6.1 | 6.1.6 |\n| 6.2 | 6.2.3 |\n| 7.0 | unaffected |\n|5 | unaffected |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected. This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)",
"id": "GHSA-62gw-3rmj-wmp2",
"modified": "2025-04-02T22:32:31Z",
"published": "2019-09-13T13:25:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/PowerShell/PowerShell/security/advisories/GHSA-62gw-3rmj-wmp2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1301"
},
{
"type": "PACKAGE",
"url": "https://github.com/PowerShell/PowerShell"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-62gw-3rmj-wmp2"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "High severity vulnerability that affects System.Management.Automation"
}
CVE-2019-1301
Vulnerability from fstec - Published: 11.09.2019
VLAI Severity ?
Title
Уязвимость программной платформы .NET Core, связанная с ошибками при обработке веб-запросов, позволяющая нарушителю вызвать отказ в обслуживании
Description
Уязвимость программной платформы .NET Core связана с ошибками при обработке веб-запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании
Severity ?
Vendor
Microsoft Corp, Red Hat Inc.
Software Name
.NET Core, PowerShell Core, Red Hat Enterprise Linux
Software Version
2.1 (.NET Core), 2.2 (.NET Core), 6.1 (PowerShell Core), 6.2 (PowerShell Core), 8 (Red Hat Enterprise Linux)
Possible Mitigations
Использование рекомендаций:
Для программных продуктов Microsoft Corp.:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2019-1301
Reference
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301
https://access.redhat.com/security/cve/cve-2019-1301
CWE
CWE-20
{
"CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp, Red Hat Inc.",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2.1 (.NET Core), 2.2 (.NET Core), 6.1 (PowerShell Core), 6.2 (PowerShell Core), 8 (Red Hat Enterprise Linux)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Microsoft Corp.:\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2019-1301",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.09.2019",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "29.05.2020",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "29.05.2020",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2020-02384",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-1301",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": ".NET Core, PowerShell Core, Red Hat Enterprise Linux",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat Inc. Red Hat Enterprise Linux 7 , Microsoft Corp Windows - , Red Hat Inc. Red Hat Enterprise Linux 8 ",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b .NET Core, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0435\u0431-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b .NET Core \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0435\u0431-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301\nhttps://access.redhat.com/security/cve/cve-2019-1301",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…