CVE-2018-0765
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Also known as GHSA-35hc-x2cw-2j4v
Published 8 y ago · modified 4 mo ago · JSON
Summary
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.
Exploit prediction (EPSS)
8.13% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | System.Security.Cryptography.Xml | <4.4.2 | 4.4.2 |
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-0765 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/104060 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1040851 · vdb-entry, x_refsource_SECTRACK, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-0765 · advisory
- github.com /advisories/GHSA-35hc-x2cw-2j4v · advisory
Sources
- CVE List: CVE-2018-0765
- GitHub Advisory: GHSA-35hc-x2cw-2j4v
- NVD: CVE-2018-0765
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.