Vulnerability-Lookup

VAR-202005-0234

Vulnerability from variot - Updated: 2024-11-24 23:05

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: .NET Core on Red Hat Enterprise Linux 7 security update Advisory ID: RHSA-2020:2476-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:2476 Issue date: 2020-06-10 CVE Names: CVE-2020-1108 ==================================================================== 1. Summary:

An update for rh-dotnet21-dotnet is now available for .NET Core on Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Relevant releases/architectures:

.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64

It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The updated version is .NET Core Runtime 2.1.19 and SDK 2.1.515.

Security Fix(es):

dotnet: Denial of service via untrusted input (CVE-2020-1108)

This is an additional update to comprehensively address CVE-2020-1108.

Default inclusions for applications built with .NET Core have been updated to reference the newest versions and their security fixes.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

1827643 - CVE-2020-1108 dotnet: Denial of service via untrusted input

Package List:

.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7):

Source: rh-dotnet21-2.1-18.el7.src.rpm rh-dotnet21-dotnet-2.1.515-1.el7.src.rpm

x86_64: rh-dotnet21-2.1-18.el7.x86_64.rpm rh-dotnet21-dotnet-2.1.515-1.el7.x86_64.rpm rh-dotnet21-dotnet-debuginfo-2.1.515-1.el7.x86_64.rpm rh-dotnet21-dotnet-host-2.1.19-1.el7.x86_64.rpm rh-dotnet21-dotnet-runtime-2.1-2.1.19-1.el7.x86_64.rpm rh-dotnet21-dotnet-sdk-2.1-2.1.515-1.el7.x86_64.rpm rh-dotnet21-dotnet-sdk-2.1.5xx-2.1.515-1.el7.x86_64.rpm rh-dotnet21-runtime-2.1-18.el7.x86_64.rpm

.NET Core on Red Hat Enterprise Linux Server (v. 7):

Source: rh-dotnet21-2.1-18.el7.src.rpm rh-dotnet21-dotnet-2.1.515-1.el7.src.rpm

.NET Core on Red Hat Enterprise Linux Workstation (v. 7):

Source: rh-dotnet21-2.1-18.el7.src.rpm rh-dotnet21-dotnet-2.1.515-1.el7.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2020-1108 https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBXuCqrtzjgjWX9erEAQgIPg/7Ba2cdZAbQ4uL6AsEoi4kN888lESbUKUM F3VebsFFw9mpaGJ+dp4O6Ihc9kKZdP6uFWq3VE5I5WPD2BcoZF/OoVfCY1FHmFy6 fWSZ0ii+Axg8Mqj4uqxlhlFujkxdeQSpfsY38rtPscLGBROEzPAZnUMH/RDXg9TD 3TdXT4SNVMQPloanzVRDPXEx4OLqgKn9ITpXLah/Jq6zsM37ZDbnM8vQ3o2nH11d 77N+M+RuGsamPfsbu8sEpgvdXkMtorUjO57PDWeWvxNiRYL/5at5TdcTePjWe5YK XANwzPRFtaEU87TFeTVbNrG3MdRl/Uk6FVbuJtNzFIxwi8+qIf1hnUpV0MZxZ1Rg o77fulouuHCSwV/j7/BN9I8Q7EJj/zm52PldVkbsR0JEr4kZMmlVxS9/VL/LroKS qFSAm8yykqI+g7b2EgBQCekIfuurbp1EPeyJ6WcVSb6kcH0xZrXE/t1u/qKIqICe Ozf/bnjDQ0ACpJTE8pAhs5NhrVXvLuz6qhu8kUHTkW6dRxqRCFhAOhnezsfeWG1K nfQOeNfny0SbIJlwh4nsWE3Zv2f/H8KYilfulHvA2SuIGg7mgE0wyPwDXCltyzEW JIlM5YyJrQOHLdjfFi8XRqcU1mFII/F9QoV6KqAoZfJ2LgjXLm9au8MNLWRkN7M1 XE8bQvAYQCc=mOEK -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202005-0234",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "visual studio 2017",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "15.9"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.7.1"
      },
      {
        "model": "visual studio 2019",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "16.5"
      },
      {
        "model": "powershell",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "7.0"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "3.5.1"
      },
      {
        "model": "visual studio 2019",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "16.0"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.7"
      },
      {
        "model": ".net core",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "3.1.4"
      },
      {
        "model": ".net core",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "3.0"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.8"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.6.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.6.2"
      },
      {
        "model": "powershell core",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "6.2"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2.0"
      },
      {
        "model": "visual studio 2019",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "16.4"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.7.2"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.6"
      },
      {
        "model": ".net core",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "3.0"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "4.5.2"
      },
      {
        "model": ".net core",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "3.1"
      },
      {
        "model": ".net",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "5.0"
      },
      {
        "model": ".net core",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "3.5"
      },
      {
        "model": ".net core",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2.1.18"
      },
      {
        "model": ".net core",
        "scope": null,
        "trust": 0.8,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": ".net framework",
        "scope": null,
        "trust": 0.8,
        "vendor": "microsoft",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:microsoft:.net_core",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:microsoft:.net_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "158007"
      },
      {
        "db": "PACKETSTORM",
        "id": "158019"
      },
      {
        "db": "PACKETSTORM",
        "id": "158020"
      },
      {
        "db": "PACKETSTORM",
        "id": "157702"
      },
      {
        "db": "PACKETSTORM",
        "id": "157794"
      },
      {
        "db": "PACKETSTORM",
        "id": "157788"
      },
      {
        "db": "PACKETSTORM",
        "id": "158021"
      },
      {
        "db": "PACKETSTORM",
        "id": "157704"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      }
    ],
    "trust": 1.4
  },
  "cve": "CVE-2020-1108",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2020-1108",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-006114",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-1108",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-006114",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-1108",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-006114",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202005-570",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka \u0027.NET Core \u0026 .NET Framework Denial of Service Vulnerability\u0027. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: .NET Core on Red Hat Enterprise Linux 7 security update\nAdvisory ID:       RHSA-2020:2476-01\nProduct:           .NET Core on Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:2476\nIssue date:        2020-06-10\nCVE Names:         CVE-2020-1108\n====================================================================\n1. Summary:\n\nAn update for rh-dotnet21-dotnet is now available for .NET Core on Red Hat\nEnterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\n.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64\n.NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64\n.NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. It implements a subset of the\n.NET framework APIs and several new APIs, and it includes a CLR\nimplementation. The updated version is .NET Core Runtime 2.1.19 and SDK 2.1.515. \n\nSecurity Fix(es):\n\n* dotnet: Denial of service via untrusted input (CVE-2020-1108)\n\nThis is an additional update to comprehensively address CVE-2020-1108. \n\nDefault inclusions for applications built with .NET Core have been updated\nto reference the newest versions and their security fixes. \n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1827643 - CVE-2020-1108 dotnet: Denial of service via untrusted input\n\n6. Package List:\n\n.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nrh-dotnet21-2.1-18.el7.src.rpm\nrh-dotnet21-dotnet-2.1.515-1.el7.src.rpm\n\nx86_64:\nrh-dotnet21-2.1-18.el7.x86_64.rpm\nrh-dotnet21-dotnet-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-debuginfo-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-host-2.1.19-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-runtime-2.1-2.1.19-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-sdk-2.1-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-sdk-2.1.5xx-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-runtime-2.1-18.el7.x86_64.rpm\n\n.NET Core on Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-dotnet21-2.1-18.el7.src.rpm\nrh-dotnet21-dotnet-2.1.515-1.el7.src.rpm\n\nx86_64:\nrh-dotnet21-2.1-18.el7.x86_64.rpm\nrh-dotnet21-dotnet-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-debuginfo-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-host-2.1.19-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-runtime-2.1-2.1.19-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-sdk-2.1-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-sdk-2.1.5xx-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-runtime-2.1-18.el7.x86_64.rpm\n\n.NET Core on Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-dotnet21-2.1-18.el7.src.rpm\nrh-dotnet21-dotnet-2.1.515-1.el7.src.rpm\n\nx86_64:\nrh-dotnet21-2.1-18.el7.x86_64.rpm\nrh-dotnet21-dotnet-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-debuginfo-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-host-2.1.19-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-runtime-2.1-2.1.19-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-sdk-2.1-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-dotnet-sdk-2.1.5xx-2.1.515-1.el7.x86_64.rpm\nrh-dotnet21-runtime-2.1-18.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-1108\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXuCqrtzjgjWX9erEAQgIPg/7Ba2cdZAbQ4uL6AsEoi4kN888lESbUKUM\nF3VebsFFw9mpaGJ+dp4O6Ihc9kKZdP6uFWq3VE5I5WPD2BcoZF/OoVfCY1FHmFy6\nfWSZ0ii+Axg8Mqj4uqxlhlFujkxdeQSpfsY38rtPscLGBROEzPAZnUMH/RDXg9TD\n3TdXT4SNVMQPloanzVRDPXEx4OLqgKn9ITpXLah/Jq6zsM37ZDbnM8vQ3o2nH11d\n77N+M+RuGsamPfsbu8sEpgvdXkMtorUjO57PDWeWvxNiRYL/5at5TdcTePjWe5YK\nXANwzPRFtaEU87TFeTVbNrG3MdRl/Uk6FVbuJtNzFIxwi8+qIf1hnUpV0MZxZ1Rg\no77fulouuHCSwV/j7/BN9I8Q7EJj/zm52PldVkbsR0JEr4kZMmlVxS9/VL/LroKS\nqFSAm8yykqI+g7b2EgBQCekIfuurbp1EPeyJ6WcVSb6kcH0xZrXE/t1u/qKIqICe\nOzf/bnjDQ0ACpJTE8pAhs5NhrVXvLuz6qhu8kUHTkW6dRxqRCFhAOhnezsfeWG1K\nnfQOeNfny0SbIJlwh4nsWE3Zv2f/H8KYilfulHvA2SuIGg7mgE0wyPwDXCltyzEW\nJIlM5YyJrQOHLdjfFi8XRqcU1mFII/F9QoV6KqAoZfJ2LgjXLm9au8MNLWRkN7M1\nXE8bQvAYQCc=mOEK\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "db": "PACKETSTORM",
        "id": "158007"
      },
      {
        "db": "PACKETSTORM",
        "id": "158019"
      },
      {
        "db": "PACKETSTORM",
        "id": "158020"
      },
      {
        "db": "PACKETSTORM",
        "id": "157702"
      },
      {
        "db": "PACKETSTORM",
        "id": "157794"
      },
      {
        "db": "PACKETSTORM",
        "id": "157788"
      },
      {
        "db": "PACKETSTORM",
        "id": "158021"
      },
      {
        "db": "PACKETSTORM",
        "id": "157704"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-1108",
        "trust": 3.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "157794",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158021",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "157704",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2021",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2010",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1814",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1691",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2061",
        "trust": 0.6
      },
      {
        "db": "NSFOCUS",
        "id": "46713",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-1108",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "158007",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "158019",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "158020",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "157702",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "157788",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "PACKETSTORM",
        "id": "158007"
      },
      {
        "db": "PACKETSTORM",
        "id": "158019"
      },
      {
        "db": "PACKETSTORM",
        "id": "158020"
      },
      {
        "db": "PACKETSTORM",
        "id": "157702"
      },
      {
        "db": "PACKETSTORM",
        "id": "157794"
      },
      {
        "db": "PACKETSTORM",
        "id": "157788"
      },
      {
        "db": "PACKETSTORM",
        "id": "158021"
      },
      {
        "db": "PACKETSTORM",
        "id": "157704"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "id": "VAR-202005-0234",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.19172932
  },
  "last_update_date": "2024-11-24T23:05:00.224000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2020-1108 | .NET Core \u0026 .NET Framework Denial of Service Vulnerability",
        "trust": 0.8,
        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1108"
      },
      {
        "title": "CVE-2020-1108 | .NET Core \u304a\u3088\u3073 .NET Framework \u306e\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u306e\u8106\u5f31\u6027",
        "trust": 0.8,
        "url": "https://portal.msrc.microsoft.com/ja-jp/security-guidance/advisory/CVE-2020-1108"
      },
      {
        "title": "Microsoft .NET Core  and .NET Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=118696"
      },
      {
        "title": "Red Hat: Important: .NET Core on Red Hat Enterprise Linux security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20202146 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: .NET Core security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20202143 - Security Advisory"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1108"
      },
      {
        "trust": 1.6,
        "url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2020-1108"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-1108"
      },
      {
        "trust": 0.8,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/cve/cve-2020-1108"
      },
      {
        "trust": 0.8,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2061/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1691/"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/46713"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157794/red-hat-security-advisory-2020-2250-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158021/red-hat-security-advisory-2020-2475-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1814/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2010/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2021/"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/microsoft-visual-studio-vulnerabilities-of-may-2020-32249"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157704/red-hat-security-advisory-2020-2146-01.html"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/errata/rhsa-2020:2146"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-1161"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1161"
      },
      {
        "trust": 0.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181094"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2450"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2476"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2471"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2143"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2250"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2249"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:2475"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "PACKETSTORM",
        "id": "158007"
      },
      {
        "db": "PACKETSTORM",
        "id": "158019"
      },
      {
        "db": "PACKETSTORM",
        "id": "158020"
      },
      {
        "db": "PACKETSTORM",
        "id": "157702"
      },
      {
        "db": "PACKETSTORM",
        "id": "157794"
      },
      {
        "db": "PACKETSTORM",
        "id": "157788"
      },
      {
        "db": "PACKETSTORM",
        "id": "158021"
      },
      {
        "db": "PACKETSTORM",
        "id": "157704"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "db": "PACKETSTORM",
        "id": "158007"
      },
      {
        "db": "PACKETSTORM",
        "id": "158019"
      },
      {
        "db": "PACKETSTORM",
        "id": "158020"
      },
      {
        "db": "PACKETSTORM",
        "id": "157702"
      },
      {
        "db": "PACKETSTORM",
        "id": "157794"
      },
      {
        "db": "PACKETSTORM",
        "id": "157788"
      },
      {
        "db": "PACKETSTORM",
        "id": "158021"
      },
      {
        "db": "PACKETSTORM",
        "id": "157704"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-05-21T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "date": "2020-06-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "date": "2020-06-10T15:06:32",
        "db": "PACKETSTORM",
        "id": "158007"
      },
      {
        "date": "2020-06-10T15:11:03",
        "db": "PACKETSTORM",
        "id": "158019"
      },
      {
        "date": "2020-06-10T15:11:11",
        "db": "PACKETSTORM",
        "id": "158020"
      },
      {
        "date": "2020-05-14T20:53:30",
        "db": "PACKETSTORM",
        "id": "157702"
      },
      {
        "date": "2020-05-21T16:41:39",
        "db": "PACKETSTORM",
        "id": "157794"
      },
      {
        "date": "2020-05-21T16:34:50",
        "db": "PACKETSTORM",
        "id": "157788"
      },
      {
        "date": "2020-06-10T15:11:23",
        "db": "PACKETSTORM",
        "id": "158021"
      },
      {
        "date": "2020-05-14T20:53:58",
        "db": "PACKETSTORM",
        "id": "157704"
      },
      {
        "date": "2020-05-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      },
      {
        "date": "2020-05-21T23:15:14.867000",
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-12-08T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-1108"
      },
      {
        "date": "2020-06-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      },
      {
        "date": "2020-06-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      },
      {
        "date": "2024-11-21T05:09:45.787000",
        "db": "NVD",
        "id": "CVE-2020-1108"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": ".NET Core and  .NET Framework Vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006114"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202005-570"
      }
    ],
    "trust": 0.6
  }
}

CVE-2020-1108 (GCVE-0-2020-1108)

Vulnerability from cvelistv5 – Published: 2020-05-21 22:53 – Updated: 2026-08-19 16:34

Title

.NET Core & .NET Framework Denial of Service Vulnerability

Summary

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.

Severity

No CVSS data available.

CWE

Denial of Service

Assigner

microsoft CNA under the mitre root

CNA scorecard B 82/100 over 3948 records in the last 180 days details

References

2 references

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch
https://portal.msrc.microsoft.com/en-US/security-…	x_refsource_MISCx_transferred

Impacted products

22 products

Vendor	Product	Version
Microsoft	.NET 5.0	Affected: 5.0.0 , < publication (custom)
Microsoft	.NET Core 2.1	Affected: 2.1 , < publication (custom)
Microsoft	.NET Core 3.1	Affected: 3.1 , < publication (custom)
Microsoft	Microsoft .NET Framework 2.0 Service Pack 2	Affected: 2.0.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.0 Service Pack 2	Affected: 3.0.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5	Affected: 3.5.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	Affected: 3.0.0.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2	Affected: 3.5.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2	Affected: 3.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	Affected: 4.7.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	Affected: 4.8.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 3.5.1	Affected: 3.5.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 4.5.2	Affected: 4.0.0.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 4.6	Affected: 4.0.0.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2	Affected: 4.0.0.0 , < publication (custom)
Microsoft	Microsoft .NET Framework 4.8	Affected: 4.8.0 , < publication (custom)
Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)	Affected: 15.9.0 , < publication (custom)
Microsoft	Microsoft Visual Studio 2019 version 16.0	Affected: 16.0 , < publication (custom)
Microsoft	Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	Affected: 16.0 , < publication (custom)
Microsoft	Microsoft Visual Studio 2019 version 16.5	Affected: 16.0 , < publication (custom)
Microsoft	PowerShell 7.0	Affected: 7.0.0 , < publication (custom)
Microsoft	PowerShell Core 6.2	Affected: 6.0 , < publication (custom)

Date Public

2020-05-12 14:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:25:01.017Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1108"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": ".NET 5.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": ".NET Core 2.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "2.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": ".NET Core 3.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2008 for 32-bit Systems Service Pack 2",
            "Windows Server 2008 for x64-based Systems Service Pack 2"
          ],
          "product": "Microsoft .NET Framework 2.0 Service Pack 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2008 for 32-bit Systems Service Pack 2",
            "Windows Server 2008 for x64-based Systems Service Pack 2"
          ],
          "product": "Microsoft .NET Framework 3.0 Service Pack 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 8.1 for 32-bit systems",
            "Windows 8.1 for x64-based systems",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 for 32-bit Systems",
            "Windows 10 for x64-based Systems"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1709 for 32-bit Systems",
            "Windows 10 Version 1709 for ARM64-based Systems",
            "Windows 10 Version 1709 for x64-based Systems"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1803 for 32-bit Systems",
            "Windows 10 Version 1803 for ARM64-based Systems",
            "Windows 10 Version 1803 for x64-based Systems",
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for ARM64-based Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows Server, version 1803  (Server Core Installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows 10 Version 1903 for 32-bit Systems",
            "Windows 10 Version 1903 for ARM64-based Systems",
            "Windows 10 Version 1903 for x64-based Systems",
            "Windows 10 Version 1909 for 32-bit Systems",
            "Windows 10 Version 1909 for ARM64-based Systems",
            "Windows 10 Version 1909 for x64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows Server, version 1903 (Server Core installation)",
            "Windows Server, version 1909 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 7 for 32-bit Systems Service Pack 1",
            "Windows 7 for x64-based Systems Service Pack 1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1"
          ],
          "product": "Microsoft .NET Framework 3.5.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 7 for 32-bit Systems Service Pack 1",
            "Windows 7 for x64-based Systems Service Pack 1",
            "Windows 8.1 for 32-bit systems",
            "Windows 8.1 for x64-based systems",
            "Windows RT 8.1",
            "Windows Server 2008 for 32-bit Systems Service Pack 2",
            "Windows Server 2008 for x64-based Systems Service Pack 2",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.5.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "4.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2008 for 32-bit Systems Service Pack 2",
            "Windows Server 2008 for x64-based Systems Service Pack 2"
          ],
          "product": "Microsoft .NET Framework 4.6",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "4.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 7 for 32-bit Systems Service Pack 1",
            "Windows 7 for x64-based Systems Service Pack 1",
            "Windows 8.1 for 32-bit systems",
            "Windows 8.1 for x64-based systems",
            "Windows RT 8.1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "4.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows 10 Version 1709 for 32-bit Systems",
            "Windows 10 Version 1709 for x64-based Systems",
            "Windows 10 Version 1803 for 32-bit Systems",
            "Windows 10 Version 1803 for x64-based Systems",
            "Windows 7 for 32-bit Systems Service Pack 1",
            "Windows 7 for x64-based Systems Service Pack 1",
            "Windows 8.1 for 32-bit systems",
            "Windows 8.1 for x64-based systems",
            "Windows RT 8.1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1",
            "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)",
            "Windows Server, version 1803  (Server Core Installation)"
          ],
          "product": "Microsoft .NET Framework 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "15.9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2019 version 16.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2019 version 16.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "16.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "PowerShell 7.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "PowerShell Core 6.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "publication",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "15.9.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "16.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "16.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "16.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "4.0.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.0.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "4.0.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:sp2:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "4.0.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "3.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "5.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:powershell_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:powershell_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "publication",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2020-05-12T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application.\nThe update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:34:04.566Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": ".NET Core \u0026 .NET Framework Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1108"
        }
      ],
      "title": ".NET Core \u0026 .NET Framework Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2020-1108",
    "datePublished": "2020-05-21T22:53:10.000Z",
    "dateReserved": "2019-11-04T00:00:00.000Z",
    "dateUpdated": "2026-08-19T16:34:04.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

VAR-202005-0234

CVE-2020-1108 (GCVE-0-2020-1108)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour