Veracode Vulnerability DatabaseVERACODE:34137Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
microsoft.aspnetcore.http.features is vulnerable to denial of service. The vulnerability exists in NET 6.0 and .NET 5.0 when kestrel web server processes certain HTTP requests causing an application crash.
References
github.com/dotnet/aspnetcore/commit/e371b5d1601f0e7c61b4cd94155d5cd2fa3f8d8d
github.com/dotnet/aspnetcore/issues/40072
github.com/dotnet/aspnetcore/pull/40087
github.com/dotnet/core/blob/main/release-notes/5.0/5.0.14/5.0.14.md
github.com/dotnet/core/blob/main/release-notes/6.0/6.0.2/6.0.2.md
lists.fedoraproject.org/archives/list/[email protected]/message/4HMQOHV7G5TF6OMBN6DNTDOKQQU7KHMM/
lists.fedoraproject.org/archives/list/[email protected]/message/CCTBSBE3PNIMXG6ALX2CQG4ZEH7W3YAT/
msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21986
news.sophos.com/en-us/2022/02/09/microsoft-fixes-52-vulnerabilities-in-february-2022-patches/
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21986
www.tenable.com/plugins/nessus/157434
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P