7.5

CVE-2017-0247

Exploit
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Abstractions Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Apiexplorer Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Cors Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Dataannotations Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Json Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Formatters.Xml Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Localization Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Razor.Host Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Taghelpers Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Viewfeatures Version 1.1.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.0.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.0.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.0.2 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.0.3 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.1.0 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.1.1 SwPlatform asp.net
Microsoft ≫ Microsoft.Aspnetcore.Mvc.Webapicompatshim Version 1.1.2 SwPlatform asp.net
Microsoft ≫ System.Net.Http Version 4.1.1 SwPlatform asp.net
Microsoft ≫ System.Net.Http Version 4.3.1 SwPlatform asp.net
Microsoft ≫ System.Net.Http.Winhttphandler Version 4.0.1 SwPlatform asp.net
Microsoft ≫ System.Net.Http.Winhttphandler Version 4.3.0 SwPlatform asp.net
Microsoft ≫ System.Net.Security Version 4.0.0 SwPlatform asp.net
Microsoft ≫ System.Net.Security Version 4.3.0 SwPlatform asp.net
Microsoft ≫ System.Net.Websockets.Client Version 4.0.0 SwPlatform asp.net
Microsoft ≫ System.Net.Websockets.Client Version 4.3.0 SwPlatform asp.net
Microsoft ≫ System.Text.Encodings.Web Version 4.0.0 SwPlatform asp.net
Microsoft ≫ System.Text.Encodings.Web Version 4.3.0 SwPlatform asp.net
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 16.91% 0.967
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/aspnet/Announcements/issues/239
Third Party Advisory
Technical Description
https://technet.microsoft.com/en-us/library/security/4021279.aspx
Patch
Vendor Advisory
https://www.sidertia.com/Home/Community/Blog/2017/05/18/ASPNET-Core-Unicode-Non-Char-Encoding-DoS
Third Party Advisory
Exploit