Skip to content
OpenAdvisories
High · 7.5 CVE-2017-0247 EUVD-2018-0527GHSA-6xh7-4v2w-36q6

ASP.NET Core fails to properly validate web requests

Published May 12, 2017 · Updated Aug 5, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ASP.NET Core Package: Microsoft.AspNetCore.Mvc Package: Microsoft.AspNetCore.Mvc.Abstractions Package: Microsoft.AspNetCore.Mvc.ApiExplorer Package: Microsoft.AspNetCore.Mvc.Core Package: Microsoft.AspNetCore.Mvc.Cors Package: Microsoft.AspNetCore.Mvc.DataAnnotations Package: Microsoft.AspNetCore.Mvc.Formatters.Json Package: Microsoft.AspNetCore.Mvc.Formatters.Xml Package: Microsoft.AspNetCore.Mvc.Localization Package: Microsoft.AspNetCore.Mvc.Razor Package: Microsoft.AspNetCore.Mvc.Razor.Host Package: Microsoft.AspNetCore.Mvc.TagHelpers Package: Microsoft.AspNetCore.Mvc.ViewFeatures Package: Microsoft.AspNetCore.Mvc.WebApiCompatShim Package: System.Net.Http Package: System.Net.Http.WinHttpHandler Package: System.Net.Security Package: System.Net.WebSockets.Client Package: System.Text.Encodings.Web Ecosystem: NuGet

Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Affected products

VendorProductAffectedFixed
Microsoft ASP.NET Core ASP.NET Core —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.Mvc >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Abstractions >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Abstractions >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.ApiExplorer >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Core >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Core >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Cors >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Cors >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.DataAnnotations >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Formatters.Json >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Formatters.Xml >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Localization >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Localization >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Razor >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Razor >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Razor.Host >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.Razor.Host >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.TagHelpers >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.TagHelpers >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.ViewFeatures >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim >= 1.0.0, < 1.0.4 1.0.4 GHSA-6xh7-4v2w-36q6
NuGet Microsoft.AspNetCore.Mvc.WebApiCompatShim >= 1.1.0, < 1.1.3 1.1.3 GHSA-6xh7-4v2w-36q6
NuGet System.Net.Http >= 4.1.1, < 4.1.2 4.1.2 GHSA-6xh7-4v2w-36q6
NuGet System.Net.Http >= 4.3.1, < 4.3.2 4.3.2 GHSA-6xh7-4v2w-36q6
NuGet System.Net.Http.WinHttpHandler >= 4.0.0, < 4.0.1 4.0.1 GHSA-6xh7-4v2w-36q6
NuGet System.Net.Http.WinHttpHandler >= 4.3.0, < 4.5.4 4.5.4 GHSA-6xh7-4v2w-36q6
NuGet System.Net.Security >= 4.0.0, < 4.0.1 4.0.1 GHSA-6xh7-4v2w-36q6
NuGet System.Net.Security >= 4.3.0, < 4.3.1 4.3.1 GHSA-6xh7-4v2w-36q6
NuGet System.Net.WebSockets.Client >= 4.0.0, < 4.0.1 4.0.1 GHSA-6xh7-4v2w-36q6
NuGet System.Net.WebSockets.Client >= 4.3.0, < 4.3.1 4.3.1 GHSA-6xh7-4v2w-36q6
NuGet System.Text.Encodings.Web >= 4.0.0, < 4.0.1 4.0.1 GHSA-6xh7-4v2w-36q6
NuGet System.Text.Encodings.Web >= 4.3.0, < 4.3.1 4.3.1 GHSA-6xh7-4v2w-36q6

References