Fluid Attacks Database

Description

Denial of service in ASP.NET Core .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
nuget	microsoft.net.http.server	>=1.0.0 <1.0.6 \|\| >=1.1.0 <1.1.4	1.0.6, 1.1.4
nuget	microsoft.aspnetcore.server.weblistener	>=1.0.0 <1.0.6 \|\| >=1.1.0 <1.1.4	1.0.6, 1.1.4
nuget	microsoft.aspnetcore.server.httpsys	>=2.0.0 <2.0.2	2.0.2

Aliases

1. CVE-2017-118832. NVD-2017-118833. OSV-2017-118834. GCVE-2017-11883

References

1. https://github.com/aspnet/Announcements/issues/2782. https://github.com/github/advisory-database/issues/3023. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11883

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.