Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core

中GHSA-cgpw-2gph-2r9g · 16/10/2018 公開 · 02/12/2024 更新

要点

GHSA-cgpw-2gph-2r9g は Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, Microsoft.AspNetCore.Server.Kestrel.Core に影響する深刻度「中」の脆弱性です。
対処：2.0.9, 2.1.2, 2.0.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
Microsoft.AspNetCore.All NuGet	`≥ 2.0.0, < 2.0.9≥ 2.1.0, < 2.1.2`	`2.0.92.1.2`
Microsoft.AspNetCore.App NuGet	`≥ 2.1.0, < 2.1.2`	`2.1.2`
Microsoft.AspNetCore.Server.Kestrel.Core NuGet	`≥ 2.0.0, < 2.0.4≥ 2.1.0, < 2.1.2`	`2.0.42.1.2`

概要

Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.

The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.