Log in Start free

Vulnerability · Published May 21, 2020 · Assigned by microsoft

CVE-2020-1108.NET Core & .NET Framework Denial of Service Vulnerability

High 7.5

In plain English

A high-severity security flaw in Microsoft .NET Framework 2.0 Service Pack 2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.5% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)6.5%top 6.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGetmicrosoft.netcore.app2.1.18GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.linux-arm3.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.linux-arm643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.linux-musl-x643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.linux-x643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.osx-x643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.rhel.6-x643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.win-arm3.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.win-arm643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.win-x643.1.4GHSA-3w5p-jhp5-c29q
NuGetmicrosoft.netcore.app.runtime.win-x863.1.4GHSA-3w5p-jhp5-c29q

Affected products (as reported)

VendorProductVersions
Microsoft .NET 5.0 5.0.0 – before publication
Microsoft .NET Core 2.1 2.1 – before publication
Microsoft .NET Core 3.1 3.1 – before publication
Microsoft Microsoft .NET Framework 2.0 Service Pack 2 2.0.0 – before publication
Microsoft Microsoft .NET Framework 3.0 Service Pack 2 3.0.0 – before publication
Microsoft Microsoft .NET Framework 3.5 3.5.0 – before publication
Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0 – before publication
Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 3.5.0 – before publication
Microsoft Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 3.0 – before publication
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 – before publication
Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.0 – before publication
Microsoft Microsoft .NET Framework 3.5.1 3.5.0 – before publication
Microsoft Microsoft .NET Framework 4.5.2 4.0.0.0 – before publication
Microsoft Microsoft .NET Framework 4.6 4.0.0.0 – before publication
Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 4.0.0.0 – before publication
Microsoft Microsoft .NET Framework 4.8 4.8.0 – before publication
Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9.0 – before publication
Microsoft Microsoft Visual Studio 2019 version 16.0 16.0 – before publication
Microsoft Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) 16.0 – before publication
Microsoft Microsoft Visual Studio 2019 version 16.5 16.0 – before publication
Microsoft PowerShell 7.0 7.0.0 – before publication
Microsoft PowerShell Core 6.2 6.0 – before publication

References