XML configuration provider implementation for Microsoft.Extensions.Configuration.

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.extensions.configuration.xml/2.0.0/microsoft.extensions.configuration.xml.2.0.0.nupkg

Vulnerable Library - system.security.cryptography.xml.4.4.0.nupkg

Provides classes to support the creation and validation of XML digital signatures. The classes in th...

Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.4.4.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.xml/4.4.0/system.security.cryptography.xml.4.4.0.nupkg

Dependency Hierarchy:

• microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.2.0.1.nupkg
    • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
      • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.identity.entityframeworkcore.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.identity.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.cookies.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.extensions.configuration.xml.2.0.0.nupkg (Root Library)

  • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.facebook.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.dataprotection.azurestorage.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.session.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
    • microsoft.aspnetcore.antiforgery.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.google.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.microsoftaccount.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
    • microsoft.aspnetcore.antiforgery.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.dataprotection.extensions.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.razorpages.2.0.2.nupkg
    • microsoft.aspnetcore.mvc.razor.2.0.2.nupkg
      • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
        • microsoft.aspnetcore.antiforgery.2.0.1.nupkg
          • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
            • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.twitter.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

Vulnerability Details

Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.

Publish Date: Jan 10, 2018 01:00 AM

URL: CVE-2018-0764

Threat Assessment

Exploit Maturity:Not Defined

EPSS:27.3%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-rr3c-f55v-qhv5

Release Date: Jan 10, 2018 01:00 AM

Fix Resolution : System.Security.Cryptography.Xml - 4.4.2

Vulnerable Library - system.security.cryptography.xml.4.4.0.nupkg

Provides classes to support the creation and validation of XML digital signatures. The classes in th...

Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.4.4.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.xml/4.4.0/system.security.cryptography.xml.4.4.0.nupkg

Dependency Hierarchy:

• microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.2.0.1.nupkg
    • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
      • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.identity.entityframeworkcore.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.identity.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.cookies.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.extensions.configuration.xml.2.0.0.nupkg (Root Library)

  • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.facebook.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.dataprotection.azurestorage.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.session.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
    • microsoft.aspnetcore.antiforgery.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.google.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.microsoftaccount.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
    • microsoft.aspnetcore.antiforgery.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.dataprotection.extensions.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
    • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.razorpages.2.0.2.nupkg
    • microsoft.aspnetcore.mvc.razor.2.0.2.nupkg
      • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
        • microsoft.aspnetcore.antiforgery.2.0.1.nupkg
          • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
            • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.twitter.2.0.1.nupkg (Root Library)

  • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • ❌ system.security.cryptography.xml.4.4.0.nupkg (Vulnerable Library)

Vulnerability Details

A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.

Publish Date: May 09, 2018 07:00 PM

URL: CVE-2018-0765

Threat Assessment

Exploit Maturity:Not Defined

EPSS:8.6%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-35hc-x2cw-2j4v

Release Date: May 09, 2018 07:00 PM

Fix Resolution : System.Security.Cryptography.Xml - 4.4.2