Certificate Validation Bypass

🗓️ 11 Jul 2018 07:34:23Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 24 Views

Certificate validation bypass in .NET Cor

Reporter	Title	Published	Views	Family All 77
CNVD	Microsoft .NET Framework Security Bypass Vulnerability (CNVD-2018-15854)	12 Jul 201800:00	–	cnvd
CVE	CVE-2018-8356	11 Jul 201800:00	–	cve
Cvelist	CVE-2018-8356	11 Jul 201800:00	–	cvelist
EUVD	EUVD-2022-4735	3 Oct 202520:07	–	euvd
Github Security Blog	Improper Certificate Validation in Microsoft .NET Framework components	14 May 202203:00	–	github
Microsoft KB	Description of the Security and Quality Rollup updates for .NET Framework 4.5.2 for Windows 8.1, RT 8.1, and Server 2012 R2 (KB 4338415)	10 Jul 201807:00	–	mskb
Microsoft KB	Description of the Security and Quality Rollup updates for .NET Framework 4.5.2 for Windows Server 2012 (KB 4338416)	10 Jul 201807:00	–	mskb
Microsoft KB	Description of the Security and Quality Rollup updates for .NET Framework 4.5.2 for Windows 7 SP1, Server 2008 R2 SP1, and Server 2008 (KB 4338417)	10 Jul 201807:00	–	mskb
Microsoft KB	Description of the Security and Quality Rollup updates for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows Server 2012 (KB 4338418)	10 Jul 201807:00	–	mskb
Microsoft KB	Description of the Security and Quality Rollup updates for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 8.1, RT 8.1, and Server 2012 R2 (KB 4338419)	10 Jul 201807:00	–	mskb

Vulners

Node

system.private.servicemodel system.private.servicemodelRange4.0.0-beta-23019–4.1.1csharp

OR

system.private.servicemodel system.private.servicemodelRange4.3.0-preview1–4.3.1csharp

OR

system.private.servicemodel system.private.servicemodelRange4.4.0-preview1–4.4.2csharp

OR

system.private.servicemodel system.private.servicemodelRange4.5.0-preview1–4.5.1csharp

OR

system.servicemodel.duplex system.servicemodel.duplexRange4.0.0-beta-22416–4.0.2csharp

OR

system.servicemodel.duplex system.servicemodel.duplexRange4.3.0-preview1–4.3.1csharp

OR

system.servicemodel.duplex system.servicemodel.duplexRange4.4.0-preview1–4.4.2csharp

OR

system.servicemodel.duplex system.servicemodel.duplexRange4.5.0-preview1–4.5.1csharp

OR

system.servicemodel.http system.servicemodel.httpRange4.4.0-preview1–4.4.2csharp

OR

system.servicemodel.http system.servicemodel.httpRange4.0.0-beta-22231–4.1.1csharp

OR

system.servicemodel.http system.servicemodel.httpRange4.3.0-preview1–4.3.1csharp

OR

system.servicemodel.http system.servicemodel.httpRange4.5.0-preview1–4.5.1csharp

OR

system.servicemodel.nettcp system.servicemodel.nettcpRange4.3.0-preview1–4.3.1csharp

OR

system.servicemodel.nettcp system.servicemodel.nettcpRange4.0.0-beta-22416–4.1.1csharp

OR

system.servicemodel.nettcp system.servicemodel.nettcpRange4.5.0-preview1–4.5.1csharp

OR

system.servicemodel.primitives system.servicemodel.primitivesRange4.0.0-beta-22231–4.1.1csharp

OR

system.servicemodel.primitives system.servicemodel.primitivesRange4.5.0-preview1–4.5.1csharp

OR

system.servicemodel.primitives system.servicemodel.primitivesRange4.4.0-preview1–4.4.2csharp

OR

system.servicemodel.primitives system.servicemodel.primitivesRange4.3.0-preview1–4.3.1csharp

OR

system.servicemodel.security system.servicemodel.securityRange4.3.0-preview1–4.3.1csharp

OR

system.servicemodel.security system.servicemodel.securityRange4.5.0-preview1–4.5.1csharp

OR

system.servicemodel.security system.servicemodel.securityRange4.4.0-preview1–4.4.2csharp

OR

system.servicemodel.security system.servicemodel.securityRange4.0.0-beta-22416–4.0.2csharp

Source	Link
github	www.github.com/dotnet/announcements/issues/73
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8356
github	www.github.com/dotnet/wcf/issues/3009
securitytracker	www.securitytracker.com/id/1041257
securityfocus	www.securityfocus.com/bid/104664
github	www.github.com/dotnet/wcf/pull/2479
github	www.github.com/dotnet/wcf/commit/a9280ed4e3f07f1824958da6ca39a66f5c1a5bb6
github	www.github.com/dotnet/wcf/pull/2478
github	www.github.com/dotnet/wcf/commit/8be0bf63d8b626f1cb9d12dbee3f93a93711ee06
github	www.github.com/dotnet/wcf/commit/c3182d46f45780e52a393aee30ff48e57dbc53ae

23 May 2022 20:12Current

6.4Medium risk

Vulners AI Score6.4

CVSS 22.1

CVSS 35.5

EPSS0.00212

certificate validation .net core security flaw expired certificates