Skip to content
OpenAdvisories
High · 7.5 CVE-2020-1045 BIT-aspnet-core-2020-1045EUVD-2022-4249GHSA-hxrm-9w7p-39cc

Microsoft ASP.NET Core Security Feature Bypass Vulnerability

Published Sep 11, 2020 · Updated Nov 18, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ASP.NET Core 2.1 Product: ASP.NET Core 3.1 Package: Microsoft.AspNetCore.App Package: Microsoft.AspNetCore.App.Runtime.linux-arm Package: Microsoft.AspNetCore.App.Runtime.linux-arm64 Package: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 Package: Microsoft.AspNetCore.App.Runtime.linux-musl-x64 Package: Microsoft.AspNetCore.App.Runtime.linux-x64 Package: Microsoft.AspNetCore.App.Runtime.osx-x64 Package: Microsoft.AspNetCore.App.Runtime.win-arm Package: Microsoft.AspNetCore.App.Runtime.win-arm64 Package: Microsoft.AspNetCore.App.Runtime.win-x64 Package: Microsoft.AspNetCore.App.Runtime.win-x86 Package: Microsoft.AspNetCore.Http Package: Microsoft.Owin Ecosystem: NuGet

Description

<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p>
<p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p>
<p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>

Affected products

VendorProductAffectedFixed
Microsoft ASP.NET Core 2.1 2.0 – < publication publication
Microsoft ASP.NET Core 3.1 3.0 – < publication publication

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 dotnet +4 3.1.108-2.el8_2 RHSA-2020:3699
RHEL 8 dotnet-host +6 3.1.8-2.el8_2 RHSA-2020:3699
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Dotnet 3 rh-dotnet31-dotnet +3 3.1.108-1.el7 RHSA-2020:3697
Red Hat Rhel Dotnet 3 rh-dotnet31-dotnet-host +6 3.1.8-1.el7 RHSA-2020:3697

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 dotnet +3 3.1.108-2.0.1.el8_2 ELSA-2020-3699
Oracle Linux 8 dotnet-host +6 3.1.8-2.0.1.el8_2 ELSA-2020-3699

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.App < 2.1.22 2.1.22 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.win-arm >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 3.1.5, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 3.1.0, < 3.1.8 3.1.8 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.AspNetCore.Http < 2.1.22 2.1.22 GHSA-hxrm-9w7p-39cc
NuGet Microsoft.Owin < 4.1.1 4.1.1 GHSA-hxrm-9w7p-39cc

Advisories 3

References