Skip to content
OpenAdvisories
High · 7.5 CVE-2018-0786 EUVD-2018-0631GHSA-jc8g-xhw5-6x46

Improper Certificate Validation in Microsoft .NET Framework components

Published Jan 10, 2018 · Updated Sep 16, 2024 · Assigned by microsoft

Vendor: Microsoft Product: .NET Framework, .NET Core, and PowerShell Core Package: Microsoft.NETCore.UniversalWindowsPlatform Package: System.Private.ServiceModel Package: System.ServiceModel.Duplex Package: System.ServiceModel.Http Package: System.ServiceModel.NetTcp Package: System.ServiceModel.Primitives Package: System.ServiceModel.Security Ecosystem: NuGet

Description

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."

Affected products

VendorProductAffectedFixed
Microsoft .NET Framework, .NET Core, and PowerShell Core Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, PowerShell Core 6.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.NETCore.UniversalWindowsPlatform >= 5.2.0, < 5.2.4 5.2.4 GHSA-jc8g-xhw5-6x46
NuGet Microsoft.NETCore.UniversalWindowsPlatform >= 5.3.0, < 5.3.5 5.3.5 GHSA-jc8g-xhw5-6x46
NuGet Microsoft.NETCore.UniversalWindowsPlatform >= 5.4.0, < 5.4.2 5.4.2 GHSA-jc8g-xhw5-6x46
NuGet Microsoft.NETCore.UniversalWindowsPlatform >= 6.0.0, < 6.0.6 6.0.6 GHSA-jc8g-xhw5-6x46
NuGet System.Private.ServiceModel >= 4.4.0, < 4.4.1 4.4.1 GHSA-jc8g-xhw5-6x46
NuGet System.Private.ServiceModel >= 4.3.0, < 4.3.1 4.3.1 GHSA-jc8g-xhw5-6x46
NuGet System.Private.ServiceModel >= 4.1.0, < 4.1.1 4.1.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Duplex >= 4.4.0, < 4.4.1 4.4.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Duplex >= 4.3.0, < 4.3.1 4.3.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Duplex >= 4.0.1, < 4.0.2 4.0.2 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Http >= 4.4.0, < 4.4.1 4.4.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Http >= 4.3.0, < 4.3.1 4.3.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Http >= 4.1.0, < 4.1.1 4.1.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.NetTcp >= 4.4.0, < 4.4.1 4.4.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.NetTcp >= 4.3.0, < 4.3.1 4.3.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.NetTcp >= 4.1.0, < 4.1.1 4.1.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Primitives >= 4.4.0, < 4.4.1 4.4.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Primitives >= 4.3.0, < 4.3.1 4.3.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Primitives >= 4.1.0, < 4.1.1 4.1.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Security >= 4.4.0, < 4.4.1 4.4.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Security >= 4.3.0, < 4.3.1 4.3.1 GHSA-jc8g-xhw5-6x46
NuGet System.ServiceModel.Security >= 4.0.1, < 4.0.2 4.0.2 GHSA-jc8g-xhw5-6x46

References