CVE-2017-0249: High severity vulnerability that affects Microsoft.AspNetCore.Mvc

Quick answers

Is CVE-2017-0249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-0249 being exploited in the wild.

How severe is CVE-2017-0249?

Low severity, with a CVSS score of 3, published 16 October 2018.

Which products and versions are affected?

DisCatSharp (NuGet) ECOSYSTEM:introduced=0,last_affected=9.8.3; Microsoft.AspNetCore.Mvc (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4; Microsoft.AspNetCore.Mvc.Abstractions (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4; Microsoft.AspNetCore.Mvc.ApiExplorer (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4; and 16 more.

Is there a fix for CVE-2017-0249?

Yes. Microsoft.AspNetCore.Mvc (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Abstractions (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.ApiExplorer (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Core (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Cors (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.DataAnnotations (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Formatters.Json (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Formatters.Xml (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Localization (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Razor (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.Razor.Host (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.TagHelpers (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.ViewFeatures (NuGet): upgrade to 1.0.4 or later; Microsoft.AspNetCore.Mvc.WebApiCompatShim (NuGet): upgrade to 1.0.4 or later; System.Net.Http (NuGet): upgrade to 4.1.2 or later; System.Net.Http.WinHttpHandler (NuGet): upgrade to 4.0.1 or later; System.Net.Security (NuGet): upgrade to 4.0.1 or later; System.Net.WebSockets.Client (NuGet): upgrade to 4.0.1 or later; System.Text.Encodings.Web (NuGet): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2017-0249?

Check whether you run DisCatSharp (NuGet), Microsoft.AspNetCore.Mvc (NuGet), Microsoft.AspNetCore.Mvc.Abstractions (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• Microsoft.AspNetCore.Mvc (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc --version 1.0.4

• Microsoft.AspNetCore.Mvc.Abstractions (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Abstractions --version 1.0.4

• Microsoft.AspNetCore.Mvc.ApiExplorer (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.ApiExplorer --version 1.0.4

• Microsoft.AspNetCore.Mvc.Core (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Core --version 1.0.4

• Microsoft.AspNetCore.Mvc.Cors (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Cors --version 1.0.4

• Microsoft.AspNetCore.Mvc.DataAnnotations (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.DataAnnotations --version 1.0.4

• Microsoft.AspNetCore.Mvc.Formatters.Json (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Formatters.Json --version 1.0.4

• Microsoft.AspNetCore.Mvc.Formatters.Xml (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Formatters.Xml --version 1.0.4

• Microsoft.AspNetCore.Mvc.Localization (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Localization --version 1.0.4

• Microsoft.AspNetCore.Mvc.Razor (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Razor --version 1.0.4

• Microsoft.AspNetCore.Mvc.Razor.Host (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.Razor.Host --version 1.0.4

• Microsoft.AspNetCore.Mvc.TagHelpers (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.TagHelpers --version 1.0.4

• Microsoft.AspNetCore.Mvc.ViewFeatures (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.ViewFeatures --version 1.0.4

• Microsoft.AspNetCore.Mvc.WebApiCompatShim (NuGet): upgrade to 1.0.4 or later

  dotnet add package Microsoft.AspNetCore.Mvc.WebApiCompatShim --version 1.0.4

• System.Net.Http (NuGet): upgrade to 4.1.2 or later

  dotnet add package System.Net.Http --version 4.1.2

• System.Net.Http.WinHttpHandler (NuGet): upgrade to 4.0.1 or later

  dotnet add package System.Net.Http.WinHttpHandler --version 4.0.1

• System.Net.Security (NuGet): upgrade to 4.0.1 or later

  dotnet add package System.Net.Security --version 4.0.1

• System.Net.WebSockets.Client (NuGet): upgrade to 4.0.1 or later

  dotnet add package System.Net.WebSockets.Client --version 4.0.1

• System.Text.Encodings.Web (NuGet): upgrade to 4.0.1 or later

  dotnet add package System.Text.Encodings.Web --version 4.0.1

Affected products

• DisCatSharp (NuGet) ECOSYSTEM:introduced=0,last_affected=9.8.3
• Microsoft.AspNetCore.Mvc (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Abstractions (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.ApiExplorer (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Core (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Cors (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.DataAnnotations (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Formatters.Json (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Formatters.Xml (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Localization (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Razor (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.Razor.Host (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.TagHelpers (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.ViewFeatures (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• Microsoft.AspNetCore.Mvc.WebApiCompatShim (NuGet) ECOSYSTEM:introduced=1.0.0,fixed=1.0.4
• System.Net.Http (NuGet) ECOSYSTEM:introduced=4.1.1,fixed=4.1.2
• System.Net.Http.WinHttpHandler (NuGet) ECOSYSTEM:introduced=4.0.0,fixed=4.0.1
• System.Net.Security (NuGet) ECOSYSTEM:introduced=4.0.0,fixed=4.0.1
• System.Net.WebSockets.Client (NuGet) ECOSYSTEM:introduced=4.0.0,fixed=4.0.1
• System.Text.Encodings.Web (NuGet) ECOSYSTEM:introduced=4.0.0,fixed=4.0.1

Identifiers

• CVE-2017-0249
• GHSA-qhqf-ghgh-x2m4