Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.0

Type nuget

Namespace

Name Microsoft.AspNetCore.Server.Kestrel.Core

Version 2.0.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 2.0.2

Latest_non_vulnerable_version 2.3.6

Affected_by_vulnerabilities

url VCID-1ur7-5ks2-7qcp

vulnerability_id VCID-1ur7-5ks2-7qcp

summary

Weak Password Recovery Mechanism for Forgotten Password
ASP.NET Core allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".

references

reference_url	https://github.com/aspnet/Announcements/issues/295
reference_id
reference_type
scores
url	https://github.com/aspnet/Announcements/issues/295

reference_url	http://www.securityfocus.com/bid/103282
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/103282

reference_url	http://www.securitytracker.com/id/1040525
reference_id
reference_type
scores
url	http://www.securitytracker.com/id/1040525

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-0787
reference_id	CVE-2018-0787
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-0787

reference_url	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787
reference_id	CVE-2018-0787
reference_type
scores
url	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0787

reference_url	https://github.com/advisories/GHSA-365p-96qv-xr7g
reference_id	GHSA-365p-96qv-xr7g
reference_type
scores
url	https://github.com/advisories/GHSA-365p-96qv-xr7g

fixed_packages

url	pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.2
purl	pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.2

aliases CVE-2018-0787, GHSA-365p-96qv-xr7g

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1ur7-5ks2-7qcp

url VCID-d4mn-hm9u-3qbk

vulnerability_id VCID-d4mn-hm9u-3qbk

summary

Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core
Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.

The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.

references

reference_url	https://github.com/aspnet/Announcements/issues/311
reference_id
reference_type
scores
url	https://github.com/aspnet/Announcements/issues/311

reference_url	https://github.com/advisories/GHSA-cgpw-2gph-2r9g
reference_id	GHSA-cgpw-2gph-2r9g
reference_type
scores
url	https://github.com/advisories/GHSA-cgpw-2gph-2r9g

fixed_packages

url	pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.4
purl	pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.4

url pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.1.2

purl pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.1.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-v6vu-9ybt-tqbc

resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.1.2

aliases GHSA-cgpw-2gph-2r9g, GMS-2018-36, GMS-2018-38, GMS-2018-44

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-d4mn-hm9u-3qbk

url VCID-dqj9-4t8f-eyhs

vulnerability_id VCID-dqj9-4t8f-eyhs

summary

Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv
Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where
a specially crafted request can cause excess resource consumption in Kestrel.

references

reference_url	https://github.com/aspnet/Announcements/issues/300
reference_id
reference_type
scores
url	https://github.com/aspnet/Announcements/issues/300

reference_url	https://github.com/advisories/GHSA-3m2r-q8x3-xmf7
reference_id	GHSA-3m2r-q8x3-xmf7
reference_type
scores
url	https://github.com/advisories/GHSA-3m2r-q8x3-xmf7

fixed_packages

url	pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.3
purl	pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.3

aliases GHSA-3m2r-q8x3-xmf7, GMS-2018-37, GMS-2018-39, GMS-2018-40, GMS-2018-43

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dqj9-4t8f-eyhs

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core@2.0.0

Package Instance