GHSA-3hcm-6fjc-47qq

NuGet Package Manager Tampering Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-0976

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	NuGet.Commands	>= 5.0.0, < 5.0.2	5.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default `obj`), aka 'NuGet Package Manager Tampering Vulnerability'.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-0976 advisory
https://github.com/NuGet/Home/issues/7908 web
https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326 web
https://github.com/NuGet/NuGet.Client package
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976 web
https://web.archive.org/web/20200227075944/http://www.securityfocus.com/bid/108210 web