CVE-2019-0564
First published: Tue Dec 18 2018(Updated: )
The methods for sending and receiving data on a WebSocket accept a CancellationToken, but previously did not implement actual support for cancellation. Activating the cancellation token would result in a no-op, and would not cancel any in progress operations. This provided a potential avenue for DOS, by tying up connections to a server with WebSocket connections that the server could not cancel.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft ASP.NET Core | =2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2019:0040
- https://github.com/aspnet/Announcements/issues/334
- https://github.com/aspnet/AspNetCore/issues/6487
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0564
- https://bugzilla.redhat.com/show_bug.cgi?id=1660634
- http://www.securityfocus.com/bid/106413
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0564
Frequently Asked Questions
What is CVE-2019-0564?
CVE-2019-0564 is a denial of service vulnerability in ASP.NET Core that allows attackers to cause a service outage by sending specially crafted web requests.
What is the severity of CVE-2019-0564?
CVE-2019-0564 has a severity rating of high, with a CVSS score of 7.5.
Which version of ASP.NET Core is affected by CVE-2019-0564?
ASP.NET Core version 2.1 is affected by CVE-2019-0564.
How can an attacker exploit CVE-2019-0564?
An attacker can exploit CVE-2019-0564 by sending specially crafted web requests to a vulnerable ASP.NET Core application, causing a denial of service.
Are there any known fixes for CVE-2019-0564?
Yes, Microsoft has released a security update to address this vulnerability. It is recommended to apply the latest updates for ASP.NET Core.
- collector/redhat-bugzilla
- alias/CVE-2019-0564
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/microsoft
- canonical/microsoft asp.net core
- version/microsoft asp.net core/2.1