Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg #114

Closed
mend-bolt-for-github bot opened this issue May 10, 2021 · 0 comments · Fixed by OPCFoundation/UA-.NETStandard#1650
Closed

CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg #114

mend-bolt-for-github bot opened this issue May 10, 2021 · 0 comments · Fixed by OPCFoundation/UA-.NETStandard#1650
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link

mend-bolt-for-github bot commented May 10, 2021 •
edited

CVE-2020-1045 - High Severity Vulnerability

Vulnerable Library - microsoft.aspnetcore.http.2.1.1.nupkg

ASP.NET Core default HTTP feature implementations.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.http.2.1.1.nupkg

Path to dependency file: /Applications/ConsoleReferenceServer/ConsoleReferenceServer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.http/2.1.1/microsoft.aspnetcore.http.2.1.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.server.kestrel.2.1.3.nupkg (Root Library)
    • microsoft.aspnetcore.hosting.2.1.1.nupkg
      • ❌ microsoft.aspnetcore.http.2.1.1.nupkg (Vulnerable Library)

Found in HEAD commit: cc7c7249fb08f768b869a09371e53abf3b2c2047

Vulnerability Details

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names., aka 'Microsoft ASP.NET Core Security Feature Bypass Vulnerability'.

Publish Date: 2020-09-11

URL: CVE-2020-1045

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: dotnet/announcements#165

Release Date: 2020-10-02

Fix Resolution: Microsoft.AspNetCore.App - 2.1.22, Microsoft.AspNetCore.All - 2.1.22,Microsoft.NETCore.App - 2.1.22, Microsoft.AspNetCore.Http - 2.1.22

Step up your Open Source Security Game with WhiteSource here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label May 10, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Oct 7, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg Oct 7, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Oct 17, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg Oct 19, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Oct 22, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Oct 22, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Oct 30, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Oct 30, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Nov 2, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Nov 6, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Nov 16, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Nov 19, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Nov 23, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Nov 23, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Nov 25, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Nov 25, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Dec 2, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Dec 3, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Dec 15, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Dec 15, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Dec 15, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Dec 16, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg Dec 18, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg, microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Dec 19, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg Dec 23, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg Dec 28, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg, microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg Dec 28, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg Dec 29, 2021
@mend-bolt-for-github mend-bolt-for-github bot changed the title CVE-2020-1045 (High) detected in microsoft.netcore.app.2.1.0.nupkg CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg Dec 29, 2021
@mregen mregen mentioned this issue Dec 29, 2021
Merged
mrsuciu pushed a commit to OPCFoundation/UA-.NETStandard that referenced this issue Dec 30, 2021
@mregen
API improvements and minor cleanup / uncritical bug fixes (#1650)
74af8ca 
* smaller API changes for .368 and minor cleanup / uncritical bug fixes
* refactor GDS server lib to get rid of UA configuration dependency
* app config builder enhancements to simplify someuse cases
-- add a few default parameter to simplify fluent API
-- Rejected folder doesn't default to pki root
-- if the leaf pki folder is already provided, the default leaf folder is stil added (e.g. becomes own/own)
* certificate validator match were to return true even if no keyId/serial number was checked
* Directory store delete cert add retry if cert is still in use.
* enable reverse connect tests on macOS
* fixes CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg mregen#114
@mregen mregen closed this as completed Jan 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

API improvements and minor cleanup / uncritical bug fixes OPCFoundation/UA-.NETStandard
1 participant
@mregen