Distributed cache implementation of Microsoft.Extensions.Caching.Distributed.IDistributedCache using...

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.extensions.caching.redis/2.0.0/microsoft.extensions.caching.redis.2.0.0.nupkg

Vulnerable Library - system.net.security.4.3.0.nupkg

Provides types, such as System.Net.Security.SslStream, that uses SSL/TLS protocols to provide secure...

Library home page: https://api.nuget.org/packages/system.net.security.4.3.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/system.net.security/4.3.0/system.net.security.4.3.0.nupkg

Dependency Hierarchy:

• microsoft.extensions.caching.redis.2.0.0.nupkg (Root Library)
  • stackexchange.redis.strongname.1.2.4.nupkg
    • ❌ system.net.security.4.3.0.nupkg (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- dvcsharp_core_api.UsersController (Application)
    - System.Net.Http.HttpClient (Extension)
        - System.Net.Http.HttpClientHandler (Extension)
            - System.Net.Http.CurlHandler (Extension)
                - Interop (Extension)
                    -> ❌ Microsoft.Win32.SafeHandles.SafeBioHandle (Vulnerable Component)

Vulnerability Details

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Publish Date: May 12, 2017 02:00 PM

URL: CVE-2017-0247

Threat Assessment

Exploit Maturity:Not Defined

EPSS:11.1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-6xh7-4v2w-36q6

Release Date: May 12, 2017 02:00 PM

Fix Resolution : System.Net.WebSockets.Client - 4.3.1,Microsoft.AspNetCore.Mvc.Core - 1.1.3,System.Net.Http - 4.3.2,System.Net.WebSockets.Client - 4.0.1,Microsoft.AspNetCore.Mvc.Razor - 1.1.3,System.Net.Http.WinHttpHandler - 4.5.4,Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,System.Net.Http.WinHttpHandler - 4.0.1,Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,System.Text.Encodings.Web - 4.0.1,Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,System.Net.Security - 4.3.1,Microsoft.AspNetCore.Mvc.Razor - 1.0.4,Microsoft.AspNetCore.Mvc.Cors - 1.0.4,System.Net.Security - 4.0.1,Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,Microsoft.AspNetCore.Mvc.DataAnnotations - 1.1.3,System.Text.Encodings.Web - 4.3.1,Microsoft.AspNetCore.Mvc.Localization - 1.1.3,Microsoft.AspNetCore.Mvc.Localization - 1.0.4,Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,Microsoft.AspNetCore.Mvc.Cors - 1.1.3,Microsoft.AspNetCore.Mvc - 1.1.3,Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.1.3,Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,System.Net.Http - 4.1.2,Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,Microsoft.AspNetCore.Mvc - 1.0.4,Microsoft.AspNetCore.Mvc.Formatters.Json - 1.1.3,Microsoft.AspNetCore.Mvc.TagHelpers - 1.1.3,Microsoft.AspNetCore.Mvc.Core - 1.0.4,Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4

Vulnerable Library - system.net.security.4.3.0.nupkg

Provides types, such as System.Net.Security.SslStream, that uses SSL/TLS protocols to provide secure...

Library home page: https://api.nuget.org/packages/system.net.security.4.3.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/system.net.security/4.3.0/system.net.security.4.3.0.nupkg

Dependency Hierarchy:

• microsoft.extensions.caching.redis.2.0.0.nupkg (Root Library)
  • stackexchange.redis.strongname.1.2.4.nupkg
    • ❌ system.net.security.4.3.0.nupkg (Vulnerable Library)

Vulnerability Details

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Publish Date: May 12, 2017 02:00 PM

URL: CVE-2017-0248

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-ch6p-4jcm-h8vh

Release Date: May 12, 2017 02:00 PM

Fix Resolution : System.Text.Encodings.Web - 4.3.1,System.Net.Security - 4.0.1,System.Text.Encodings.Web - 4.0.1,Microsoft.AspNetCore.Mvc.Localization - 1.1.3,Microsoft.AspNetCore.Mvc.DataAnnotations - 1.1.3,Microsoft.AspNetCore.Mvc.Razor - 1.1.3,Microsoft.AspNetCore.Mvc.Cors - 1.0.4,Microsoft.AspNetCore.Mvc.Razor - 1.0.4,System.Net.Http - 4.3.2,System.Net.Http.WinHttpHandler - 4.3.1,Microsoft.AspNetCore.Mvc.Formatters.Json - 1.1.3,Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.1.3,Microsoft.AspNetCore.Mvc.Core - 1.0.4,Microsoft.AspNetCore.Mvc.Cors - 1.1.3,System.Net.Security - 4.3.1,Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,System.Net.WebSockets.Client - 4.0.1,Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,System.Net.Http - 4.1.2,Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,Microsoft.AspNetCore.Mvc - 1.1.3,System.Net.WebSockets.Client - 4.3.1,Microsoft.AspNetCore.Mvc.TagHelpers - 1.1.3,Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,Microsoft.AspNetCore.Mvc - 1.0.4,Microsoft.AspNetCore.Mvc.Localization - 1.0.4,Microsoft.AspNetCore.Mvc.Core - 1.1.3,Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,System.Net.Http.WinHttpHandler - 4.0.1,Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

• system.identitymodel.tokens.jwt.5.2.2.nupkg (Root Library)

  • microsoft.identitymodel.tokens.5.2.2.nupkg
    • system.runtime.serialization.xml.4.3.0.nupkg
      • system.private.datacontractserialization.4.3.0.nupkg
        • system.xml.xdocument.4.3.0.nupkg
          • system.xml.readerwriter.4.3.0.nupkg
            • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

  • microsoft.identitymodel.protocols.openidconnect.2.1.4.nupkg
    • microsoft.identitymodel.protocols.2.1.4.nupkg
      • system.identitymodel.tokens.jwt.5.2.2.nupkg
        • microsoft.identitymodel.tokens.5.2.2.nupkg
          • system.runtime.serialization.xml.4.3.0.nupkg
            • system.private.datacontractserialization.4.3.0.nupkg
              • system.xml.xdocument.4.3.0.nupkg
                • system.xml.readerwriter.4.3.0.nupkg
                  • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.extensions.configuration.azurekeyvault.2.0.0.nupkg (Root Library)

  • microsoft.identitymodel.clients.activedirectory.3.14.1.nupkg
    • system.runtime.serialization.json.4.0.2.nupkg
      • system.private.datacontractserialization.4.3.0.nupkg
        • system.xml.xdocument.4.3.0.nupkg
          • system.xml.readerwriter.4.3.0.nupkg
            • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.taghelpers.2.0.2.nupkg
    • microsoft.aspnetcore.mvc.razor.2.0.2.nupkg
      • microsoft.codeanalysis.csharp.2.3.1.nupkg
        • microsoft.codeanalysis.common.2.3.1.nupkg
          • system.xml.xdocument.4.3.0.nupkg
            • system.xml.readerwriter.4.3.0.nupkg
              • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.taghelpers.2.0.2.nupkg
    • microsoft.aspnetcore.mvc.razor.2.0.2.nupkg
      • microsoft.codeanalysis.csharp.2.3.1.nupkg
        • microsoft.codeanalysis.common.2.3.1.nupkg
          • system.xml.xdocument.4.3.0.nupkg
            • system.xml.readerwriter.4.3.0.nupkg
              • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

  • microsoft.identitymodel.protocols.openidconnect.2.1.4.nupkg
    • microsoft.identitymodel.protocols.2.1.4.nupkg
      • system.identitymodel.tokens.jwt.5.2.2.nupkg
        • microsoft.identitymodel.tokens.5.2.2.nupkg
          • system.runtime.serialization.xml.4.3.0.nupkg
            • system.private.datacontractserialization.4.3.0.nupkg
              • system.xml.xdocument.4.3.0.nupkg
                • system.xml.readerwriter.4.3.0.nupkg
                  • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.extensions.caching.redis.2.0.0.nupkg (Root Library)

  • stackexchange.redis.strongname.1.2.4.nupkg
    • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

• microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

  • microsoft.aspnetcore.mvc.razorpages.2.0.2.nupkg
    • microsoft.aspnetcore.mvc.razor.2.0.2.nupkg
      • microsoft.codeanalysis.csharp.2.3.1.nupkg
        • microsoft.codeanalysis.common.2.3.1.nupkg
          • system.xml.xdocument.4.3.0.nupkg
            • system.xml.readerwriter.4.3.0.nupkg
              • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981. After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: May 16, 2019 06:17 PM

URL: CVE-2019-0820

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.7%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: May 16, 2019 06:17 PM

Fix Resolution : System.Text.RegularExpressions - 4.3.1

Vulnerable Library - system.net.security.4.3.0.nupkg

Provides types, such as System.Net.Security.SslStream, that uses SSL/TLS protocols to provide secure...

Library home page: https://api.nuget.org/packages/system.net.security.4.3.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/system.net.security/4.3.0/system.net.security.4.3.0.nupkg

Dependency Hierarchy:

• microsoft.extensions.caching.redis.2.0.0.nupkg (Root Library)
  • stackexchange.redis.strongname.1.2.4.nupkg
    • ❌ system.net.security.4.3.0.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: May 12, 2017 02:00 PM

URL: CVE-2017-0256

Threat Assessment

Exploit Maturity:Not Defined

EPSS:4.3%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin: GHSA-j8f4-2w4p-mhjc

Release Date: May 12, 2017 02:00 PM

Fix Resolution : Microsoft.AspNetCore.Mvc.Formatters.Json - 1.1.3,System.Net.WebSockets.Client - 4.0.1,Microsoft.AspNetCore.Mvc - 1.0.4,System.Text.Encodings.Web - 4.3.1,Microsoft.AspNetCore.Mvc.Cors - 1.1.3,Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,System.Net.Http - 4.3.2,Microsoft.AspNetCore.Mvc.Razor - 1.1.3,System.Net.WebSockets.Client - 4.3.1,Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.1.3,Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,Microsoft.AspNetCore.Mvc.Localization - 1.0.4,Microsoft.AspNetCore.Mvc.Core - 1.0.4,System.Text.Encodings.Web - 4.0.1,Microsoft.AspNetCore.Mvc.TagHelpers - 1.1.3,Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,Microsoft.AspNetCore.Mvc.Localization - 1.1.3,Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,Microsoft.AspNetCore.Mvc.Razor - 1.0.4,Microsoft.AspNetCore.Mvc - 1.1.3,Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,System.Net.Security - 4.0.1,System.Net.Http.WinHttpHandler - 4.0.1,System.Net.Http - 4.1.2,Microsoft.AspNetCore.Mvc.Core - 1.1.3,Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,Microsoft.AspNetCore.Mvc.Cors - 1.0.4,System.Net.Security - 4.3.1,System.Net.Http.WinHttpHandler - 4.3.1,Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,Microsoft.AspNetCore.Mvc.DataAnnotations - 1.1.3