Skip to content
OpenAdvisories
High CVE-2020-0603 BIT-aspnet-core-2020-0603EUVD-2022-2713GHSA-655q-9gvg-q4cm

Remote code execution in ASP.NET Core

Published Jan 14, 2020 · Updated Aug 4, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ASP.NET Core Package: Microsoft.AspNetCore.All Package: Microsoft.AspNetCore.App Package: Microsoft.AspNetCore.App.Runtime.linux-arm Package: Microsoft.AspNetCore.App.Runtime.linux-arm64 Package: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 Package: Microsoft.AspNetCore.App.Runtime.linux-musl-x64 Package: Microsoft.AspNetCore.App.Runtime.linux-x64 Package: Microsoft.AspNetCore.App.Runtime.osx-x64 Package: Microsoft.AspNetCore.App.Runtime.win-arm Package: Microsoft.AspNetCore.App.Runtime.win-x64 Package: Microsoft.AspNetCore.App.Runtime.win-x86 Package: Microsoft.AspNetCore.Http.Connections Ecosystem: NuGet

Description

A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

Affected products

VendorProductAffectedFixed
Microsoft ASP.NET Core 2.1, 3.0, 3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 dotnet +4 3.0.102-2.el8_1 RHSA-2020:0130
RHEL 8 dotnet-host +6 3.0.2-2.el8_1 RHSA-2020:0130
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Dotnet 3 rh-dotnet30-dotnet +3 3.0.102-3.el7 RHSA-2020:0134
Red Hat Rhel Dotnet 3 rh-dotnet30-dotnet-host +6 3.0.2-3.el7 RHSA-2020:0134
Red Hat Rhel Dotnet 3 rh-dotnet31-dotnet +3 3.1.101-4.el7 RHSA-2020:0134
Red Hat Rhel Dotnet 3 rh-dotnet31-dotnet-host +6 3.1.1-4.el7 RHSA-2020:0134

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 dotnet +3 3.0.102-2.0.1.el8_1 ELSA-2020-0130
Oracle Linux 8 dotnet-host +6 3.0.2-2.0.1.el8_1 ELSA-2020-0130

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.All >= 2.1.0, < 2.1.15 2.1.15 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App >= 3.0.0, < 3.0.1 3.0.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App >= 2.1.0, < 2.1.15 2.1.15 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 3.1.0, < 3.1.1 3.1.1 GHSA-655q-9gvg-q4cm
NuGet Microsoft.AspNetCore.Http.Connections >= 1.0.0, < 1.0.15 1.0.15 GHSA-655q-9gvg-q4cm

Advisories 3

References