Description
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | PowerShell Core | 6.0 | — |
| Microsoft | .NET Core | 1.0, 1.1, 2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 1 | rh-dotnetcore10-dotnetcore | 1.0.13-1.el7 | RHSA-2018:2902 |
| Red Hat Rhel Dotnet 1 | rh-dotnetcore11-dotnetcore | 1.1.10-1.el7 | RHSA-2018:2902 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | System.Net.Http | < 4.3.4 | 4.3.4 | GHSA-7jgj-8wvc-jh57 |
Advisories 1
- RHSA-2018:2902 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2018:2902 vendor-advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8292
- 105548 vdb-entry