The vulnerability of the `JsonSerializer.DeserializeAsyncEnumerable` method in the System.Text.Json library of the Microsoft.NET software platform and the Microsoft Visual Studio development tools allows a attacker to cause a service failure.

🗓️ 15 Jul 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

JsonSerializer.DeserializeAsyncEnumerable vulnerability in System.Text.Json causes resource exhaustion and service failure.

Reporter	Title	Published	Views	Family All 86
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 1.15.0 IF001	31 Jul 202409:07	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Microsoft .NET affects IBM Robotic Process Automation and may lead to a denial of service (CVE-2024-30105).	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	15 Apr 202503:59	–	ibm
Tenable Nessus	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2024-686)	6 Aug 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : dotnet8.0 (ALSA-2024:4450)	11 Jul 202400:00	–	nessus
Tenable Nessus	AlmaLinux 8 : dotnet8.0 (ALSA-2024:4451)	11 Jul 202400:00	–	nessus
Tenable Nessus	MiracleLinux 9 : dotnet8.0-8.0.107-1.el9_4.ML.1 (AXSA:2024-8561:13)	20 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : dotnet8.0-8.0.107-1.el8_10.ML.1 (AXSA:2024-8565:14)	20 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : dotnet8.0 (ELSA-2024-4450)	10 Jul 202400:00	–	nessus
Tenable Nessus	Oracle Linux 8 : dotnet8.0 (ELSA-2024-4451)	10 Jul 202400:00	–	nessus

Vulners

Node

microsoft microsoft_visual_studio_2022Match17.4

OR

microsoft microsoft_visual_studio_2022Match17.6

OR

microsoft .netMatch8.0

OR

microsoft system.text.jsonRange7.0.0–8.0.3

OR

microsoft microsoft_visual_studio_2022Match17.10

OR

microsoft microsoft_visual_studio_2022Match17.8

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30105
github	www.github.com/dotnet/runtime/issues/104619
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

26 Jul 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.02915

deserialize async enumerable json serializer system text json resource exhaustion service failure dotnet vulnerability attacker