Repository navigation
microsoft.netcore.app.2.0.0.nupkg: 3 vulnerabilities (highest severity is: 9.8) [master] (unreachable) #63
Description
📂 Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model.
e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d
When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /dvcsharp-core-api.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Findings
| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-986114-454437 | 🟣 Critical | 9.8 | N/A | N/A | microsoft.netcore.app.2.0.0.nupkg | Direct | N/A | ❌ | |
| CVE-2017-11770 | 🔴 High | 8.7 | Not Defined | 13.0% | microsoft.netcore.app.2.0.0.nupkg | Direct | System.Security.Cryptography.X509Certificates - 4.1.2,Microsoft.NETCore.App - 2.0.3 | ✅ | |
| CVE-2018-8292 | 🔴 High | 8.7 | Not Defined | 4.7% | microsoft.netcore.app.2.0.0.nupkg | Direct | System.Net.Http - 4.3.4 | ✅ |  Unreachable |
Details
🟣CVE-986114-454437
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model.
e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d
When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /dvcsharp-core-api.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Dependency Hierarchy:
- ❌ microsoft.netcore.app.2.0.0.nupkg (Vulnerable Library)
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-986114-454437
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🔴CVE-2017-11770
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model.
e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d
When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /dvcsharp-core-api.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Dependency Hierarchy:
- ❌ microsoft.netcore.app.2.0.0.nupkg (Vulnerable Library)
Vulnerability Details
.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".
Publish Date: Nov 15, 2017 03:00 AM
URL: CVE-2017-11770
Threat Assessment
Exploit Maturity:Not Defined
EPSS:13.0%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-7mfr-774f-w5r9
Release Date: Nov 15, 2017 03:00 AM
Fix Resolution : System.Security.Cryptography.X509Certificates - 4.1.2,Microsoft.NETCore.App - 2.0.3
🔴CVE-2018-8292
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model.
e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d
When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /dvcsharp-core-api.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Dependency Hierarchy:
- ❌ microsoft.netcore.app.2.0.0.nupkg (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Publish Date: Oct 10, 2018 01:00 PM
URL: CVE-2018-8292
Threat Assessment
Exploit Maturity:Not Defined
EPSS:4.7%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-7jgj-8wvc-jh57
Release Date: Oct 10, 2018 01:00 PM
Fix Resolution : System.Net.Http - 4.3.4
Activity
[-]microsoft.netcore.app.2.0.0.nupkg: 2 vulnerabilities (highest severity is: 8.7) [master] (reachable)[/-][+]microsoft.netcore.app.2.0.0.nupkg: 3 vulnerabilities (highest severity is: 9.8) [master] (reachable)[/+][-]microsoft.netcore.app.2.0.0.nupkg: 3 vulnerabilities (highest severity is: 9.8) [master] (reachable)[/-][+]microsoft.netcore.app.2.0.0.nupkg: 3 vulnerabilities (highest severity is: 9.8) [master] (unreachable)[/+]