GHSA-mv2r-q4g5-j8q5
Denial of service in ASP.NET Core
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | Microsoft.Data.OData | < 5.8.4 | 5.8.4 |
| NuGet | Microsoft.AspNetCore.DataProtection.AzureStorage | >= 2.1.0, < 2.1.13 | 2.1.13 |
| NuGet | Microsoft.AspNetCore.DataProtection.AzureStorage | >= 2.2.0, < 2.2.7 | 2.2.7 |
| NuGet | Microsoft.AspNetCore.All | >= 2.1.0, < 2.1.13 | 2.1.13 |
| NuGet | Microsoft.AspNetCore.All | >= 2.2.0, < 2.2.7 | 2.2.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." This affects Microsoft.Data.OData.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2018-8269
- https://github.com/aspnet/Announcements/issues/385
- https://github.com/github/advisory-database/issues/302
- https://github.com/advisories/GHSA-mv2r-q4g5-j8q5
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8269
- https://www.exploit-db.com/exploits/46101