Description
.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET Core | .NET Core 1.0, .NET Core 1.1, and .NET Core 2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 2 | rh-dotnet20-dotnet +3 | 2.0.3-4.el7 | RHSA-2017:3248 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore10-dotnetcore | 1.0.8-1.el7 | RHSA-2017:3248 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore11-dotnetcore | 1.1.5-1.el7 | RHSA-2017:3248 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.NETCore.App | >= 1.0.0, < 2.0.3 | 2.0.3 | GHSA-7mfr-774f-w5r9 |
| NuGet | System.Security.Cryptography.X509Certificates | >= 4.0.0, < 4.1.2 | 4.1.2 | GHSA-7mfr-774f-w5r9 |
Advisories 1
- RHSA-2017:3248 Red Hat Security Advisory: .NET Core security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 1039787 vdb-entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770
- RHSA-2017:3248 vendor-advisory
- 101710 vdb-entry