{"containers": {"cna": {"affected": [{"product": ".NET Core", "vendor": "Microsoft Corporation", "versions": [{"status": "affected", "version": ".NET Core 1.0, .NET Core 1.1, and .NET Core 2.0"}]}], "datePublic": "2017-11-14T00:00:00", "descriptions": [{"lang": "en", "value": ".NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka \".NET CORE Denial Of Service Vulnerability\"."}], "problemTypes": [{"descriptions": [{"description": "Denial of Service", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-12-01T21:57:01", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "1039787", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1039787"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770"}, {"name": "RHSA-2017:3248", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:3248"}, {"name": "101710", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/101710"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "DATE_PUBLIC": "2017-11-14T00:00:00", "ID": "CVE-2017-11770", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": ".NET Core", "version": {"version_data": [{"version_value": ".NET Core 1.0, .NET Core 1.1, and .NET Core 2.0"}]}}]}, "vendor_name": "Microsoft Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": ".NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka \".NET CORE Denial Of Service Vulnerability\"."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Denial of Service"}]}]}, "references": {"reference_data": [{"name": "1039787", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1039787"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770"}, {"name": "RHSA-2017:3248", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:3248"}, {"name": "101710", "refsource": "BID", "url": "http://www.securityfocus.com/bid/101710"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:19:38.755Z"}, "title": "CVE Program Container", "references": [{"name": "1039787", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1039787"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770"}, {"name": "RHSA-2017:3248", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:3248"}, {"name": "101710", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/101710"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2017-11770", "datePublished": "2017-11-15T03:00:00Z", "dateReserved": "2017-07-31T00:00:00", "dateUpdated": "2024-09-16T22:41:39.922Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:aspnetcore:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "931E8C70-B5A4-43BA-8878-12DCE3BB7887", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:aspnetcore:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5AE520B3-FDFE-44DC-B299-F78934491AB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:aspnetcore:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "A6C2F277-29BA-4E33-B2FF-2DA5CE744DFE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": ".NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka \".NET CORE Denial Of Service Vulnerability\"."}, {"lang": "es", "value": ".NET Core 1.0, 1.1 y 2.0 permite que un atacante no autenticado provoque un ataque de denegaci\u00f3n de servicio (DoS) de forma remota contra una aplicaci\u00f3n web de .NET Core analizando incorrectamente datos de certificados. Existe una vulnerabilidad de denegaci\u00f3n de servicio (DoS) cuando .NET Core gestiona de manera incorrecta en an\u00e1lisis sint\u00e1ctico de datos de certificados. Esta vulnerabilidad tambi\u00e9n se conoce como \".NET CORE Denial Of Service Vulnerability\"."}], "id": "CVE-2017-11770", "lastModified": "2019-04-16T20:01:07.733", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-11-15T03:29:00.247", "references": [{"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101710"}, {"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039787"}, {"source": "secure@microsoft.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3248"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnet20-dotnet-0:2.0.3-4.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.8-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.5-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnet20-dotnet-0:2.0.3-4.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.8-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.5-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:2.0::el7", "package": "rh-dotnet20-dotnet-0:2.0.3-4.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:2.0::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.8-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}, {"advisory": "RHSA-2017:3248", "cpe": "cpe:/a:redhat:rhel_dotnet:2.0::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.5-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2017-11-20T00:00:00Z"}], "bugzilla": {"description": "Core: DoS via bad certificate", "id": "1512992", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1512992"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": [".NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka \".NET CORE Denial Of Service Vulnerability\"."], "name": "CVE-2017-11770", "public_date": "2017-11-14T22:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-11770\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-11770\nhttps://github.com/dotnet/announcements/issues/44"], "threat_severity": "Low", "upstream_fix": "dotnet 2.0.3, dotnetcore 1.0.7, dotnetcore 1.1.4"}