tina94happy/BookMaintainBackStage

System.Net.Http-4.6.24705.01.dll: 1 vulnerabilities (highest severity is: 7.5)

mend-bolt-for-github opened this issue · 0 comments

mend-bolt-for-github commented
Vulnerable Library - System.Net.Http-4.6.24705.01.dll

System.Net.Http

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to vulnerable library: /bin/roslyn/System.Net.Http.dll,/packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/System.Net.Http.dll

Found in HEAD commit: d2e2128c41346d441697d714b590377982de861b

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (System.Net.Http version) Remediation Possible**
CVE-2018-8292 High 7.5 System.Net.Http-4.6.24705.01.dll Direct System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-8292

Vulnerable Library - System.Net.Http-4.6.24705.01.dll

System.Net.Http

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to vulnerable library: /bin/roslyn/System.Net.Http.dll,/packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/System.Net.Http.dll

Dependency Hierarchy:

  • ❌ System.Net.Http-4.6.24705.01.dll (Vulnerable Library)

Found in HEAD commit: d2e2128c41346d441697d714b590377982de861b

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Step up your Open Source Security Game with Mend here