CVE-2018-8356
Improper Certificate Validation in Microsoft .NET Framework components
Also known as GHSA-p9wx-v264-q34p
Published 8 y ago · modified 4 mo ago · JSON
Summary
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.
Exploit prediction (EPSS)
0.75% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | System.Private.ServiceModel | >=4.0.0, <4.1.3 >=4.3.0, <4.3.3 >=4.4.0, <4.4.4 >=4.5.0, <4.5.3 | 4.1.3 4.3.3 4.4.4 4.5.3 |
| nuget | System.ServiceModel.Duplex | >=4.3.0, <4.3.3 >=4.4.0, <4.4.4 >=4.5.0, <4.5.3 >=4.0.0, <4.0.4 | 4.3.3 4.4.4 4.5.3 4.0.4 |
| nuget | System.ServiceModel.Http | >=4.3.0, <4.3.3 >=4.4.0, <4.4.4 >=4.5.0, <4.5.3 >=4.0.0, <4.1.3 | 4.3.3 4.4.4 4.5.3 4.1.3 |
| nuget | System.ServiceModel.NetTcp | >=4.3.0, <4.3.3 >=4.4.0, <4.4.4 >=4.5.0, <4.5.3 >=4.0.0, <4.1.3 | 4.3.3 4.4.4 4.5.3 4.1.3 |
| nuget | System.ServiceModel.Primitives | >=4.3.0, <4.3.3 >=4.4.0, <4.4.4 >=4.5.0, <4.5.3 >=4.0.0, <4.1.3 | 4.3.3 4.4.4 4.5.3 4.1.3 |
| nuget | System.ServiceModel.Security | >=4.3.0, <4.3.3 >=4.4.0, <4.4.4 >=4.5.0, <4.5.3 >=4.0.0, <4.0.4 | 4.3.3 4.4.4 4.5.3 4.0.4 |
Affected products
- Microsoft Microsoft .NET Framework
- Microsoft .NET Core
- Microsoft ASP.NET Core
- Microsoft .NET Framework
Classification
- Weakness
- CWE-295 Improper Certificate Validation
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8356 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/104664 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1041257 · vdb-entry, x_refsource_SECTRACK, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-8356 · advisory
- github.com /dotnet/announcements/issues/73 · web
- github.com /github/advisory-database/issues/302 · web
Sources
- CVE List: CVE-2018-8356
- GitHub Advisory: GHSA-p9wx-v264-q34p
- NVD: CVE-2018-8356
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.