CVE-2019-0564: High severity asp.net core vulnerability
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
Other sources
The methods for sending and receiving data on a WebSocket accept a CancellationToken, but previously did not implement actual support for cancellation. Activating the cancellation token would result in a no-op, and would not cancel any in progress operations. This provided a potential avenue for DOS, by tying up connections to a server with WebSocket connections that the server could not cancel.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-0564?
CVE-2019-0564 is a denial of service vulnerability in ASP.NET Core that allows attackers to cause a service outage by sending specially crafted web requests.
What is the severity of CVE-2019-0564?
CVE-2019-0564 has a severity rating of high, with a CVSS score of 7.5.
Which version of ASP.NET Core is affected by CVE-2019-0564?
ASP.NET Core version 2.1 is affected by CVE-2019-0564.
How can an attacker exploit CVE-2019-0564?
An attacker can exploit CVE-2019-0564 by sending specially crafted web requests to a vulnerable ASP.NET Core application, causing a denial of service.
Are there any known fixes for CVE-2019-0564?
Yes, Microsoft has released a security update to address this vulnerability. It is recommended to apply the latest updates for ASP.NET Core.