Description
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET Core | 2.1, 2.2 | — |
| Microsoft | Microsoft .NET Framework | 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2, 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2, 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Syste… | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 2 | rh-dotnet21 +1 | 2.1-6.el7 | RHSA-2019:0040 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21-dotnet +2 | 2.1.503-1.el7 | RHSA-2019:0040 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21-dotnet-host +1 | 2.1.7-1.el7 | RHSA-2019:0040 |
| Red Hat Rhel Dotnet 2 | rh-dotnet22 +1 | 2.2-2.el7 | RHSA-2019:0040 |
| Red Hat Rhel Dotnet 2 | rh-dotnet22-dotnet +2 | 2.2.102-1.el7 | RHSA-2019:0040 |
| Red Hat Rhel Dotnet 2 | rh-dotnet22-dotnet-host +2 | 2.2.1-1.el7 | RHSA-2019:0040 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.NETCore.App | >= 2.1.0, < 2.1.7 | 2.1.7 | GHSA-2xjx-v99w-gqf3 |
| NuGet | Microsoft.NETCore.App | >= 2.2.0, < 2.2.1 | 2.2.1 | GHSA-2xjx-v99w-gqf3 |
Advisories 1
- RHSA-2019:0040 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0545
- 106405 vdb-entry
- RHSA-2019:0040 vendor-advisory