CVE-2020-1108
.NET Core & .NET Framework Denial of Service Vulnerability
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
- Record
CVE-2020-1108- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
.NET Core & .NET Framework Denial of Service Vulnerability
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
- Record
CVE-2020-1108- Updated
- 2026-11-02
EUVDEUVD-2022-2252 No score
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
- Record
EUVD-2022-2252- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3w5p-jhp5-c29q
.NET Core & .NET Framework Denial of Service Vulnerability
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.
- Record
GHSA-3w5p-jhp5-c29q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
- Record
CVE-2020-1108- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-3w5p-jhp5-c29q
.NET Core & .NET Framework Denial of Service Vulnerability
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.
- Record
GHSA-3w5p-jhp5-c29q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2020:2143
Red Hat Security Advisory: .NET Core security update
- Record
RHSA-2020:2143- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2146
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update
- Record
RHSA-2020:2146- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2249
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update
- Record
RHSA-2020:2249- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2250
Red Hat Security Advisory: dotnet3.1 security update
- Record
RHSA-2020:2250- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2450
Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux 8 security update
- Record
RHSA-2020:2450- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2471
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux 8 security update
- Record
RHSA-2020:2471- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2475
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux 7 security update
- Record
RHSA-2020:2475- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2476
Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux 7 security update
- Record
RHSA-2020:2476- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-dotnet-2020-1108 No score
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.
- Record
BIT-dotnet-2020-1108- Updated
- 2026-11-02
OSVBIT-dotnet-sdk-2020-1108 No score
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.
- Record
BIT-dotnet-sdk-2020-1108- Updated
- 2026-11-02
OSVBIT-powershell-2020-1108 No score
.NET Core & .NET Framework Denial of Service Vulnerability
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.
- Record
BIT-powershell-2020-1108- Updated
- 2026-11-02
Affected products
- microsoft .net
- microsoft .net core
- microsoft .net framework
- microsoft .net 5.0
- microsoft .net core 2.1
- microsoft .net core 3.1
- microsoft .net framework 2.0 service pack 2
- microsoft .net framework 3.0 service pack 2
- microsoft .net framework 3.5
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2
- microsoft .net framework 3.5 and 4.6/4.6.1/4.6.2
- microsoft .net framework 3.5 and 4.7.1/4.7.2
Show 17 moreShow less
- microsoft .net framework 3.5 and 4.7.2
- microsoft .net framework 3.5 and 4.8
- microsoft .net framework 3.5.1
- microsoft .net framework 4.5.2
- microsoft .net framework 4.6
- microsoft .net framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
- microsoft .net framework 4.8
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)
- microsoft visual studio 2019 version 16.0
- microsoft visual studio 2019 version 16.4 (includes 16.0 - 16.3)
- microsoft visual studio 2019 version 16.5
- microsoft powershell
- microsoft powershell 7.0
- microsoft powershell core 6.2
- microsoft powershell core
- microsoft visual studio 2017
- microsoft visual studio 2019
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.AppNuGet |
2.1.0 up to 2.1.18 | 2.1.18 |
Microsoft.NETCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.rhel.6-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Show 115 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
Microsoft.NETCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.4 | 3.1.4 |
dotnetBitnami |
5.0-preview1.0 to 5.0-preview1.0, 5.0-preview2.0 to 5.0-preview2.0, 5.0-preview3.0 to 5.0-preview3.0 | None known |
dotnet-sdkBitnami |
5.0-preview1.0 to 5.0-preview1.0, 5.0-preview2.0 to 5.0-preview2.0, 5.0-preview3.0 to 5.0-preview3.0 | None known |
powershellBitnami |
7.0.0 to 7.0.0 | None known |
Microsoft.NETCore.AppNuGet |
2.1.0 up to 2.1.18, plus listed versions 2.1.12.1.102.1.112.1.122.1.13 Show 12 moreShow less2.1.142.1.152.1.162.1.172.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9 |
2.1.18 |
Microsoft.NETCore.App.Runtime.linux-armNuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.linux-arm64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.linux-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.osx-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.rhel.6-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.win-armNuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.win-x64NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
Microsoft.NETCore.App.Runtime.win-x86NuGet |
3.1.0 up to 3.1.4, plus listed versions 3.1.13.1.23.1.3 |
3.1.4 |
dotnetRed Hat:enterprise_linux:8::appstream |
before 0:2.1.514-2.el8_2 | 0:2.1.514-2.el8_2 |
dotnet-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.514-2.el8_2 | 0:2.1.514-2.el8_2 |
dotnet-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.1.514-2.el8_2 | 0:2.1.514-2.el8_2 |
dotnet-host-fxr-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.18-2.el8_2 | 0:2.1.18-2.el8_2 |
dotnet-host-fxr-2.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.18-2.el8_2 | 0:2.1.18-2.el8_2 |
dotnet-runtime-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.18-2.el8_2 | 0:2.1.18-2.el8_2 |
dotnet-runtime-2.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.18-2.el8_2 | 0:2.1.18-2.el8_2 |
dotnet-sdk-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.514-2.el8_2 | 0:2.1.514-2.el8_2 |
dotnet-sdk-2.1.5xxRed Hat:enterprise_linux:8::appstream |
before 0:2.1.514-2.el8_2 | 0:2.1.514-2.el8_2 |
dotnet-sdk-2.1.5xx-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.514-2.el8_2 | 0:2.1.514-2.el8_2 |
rh-dotnet21Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-17.el7 | 0:2.1-17.el7 |
rh-dotnet21-dotnetRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.514-2.el7 | 0:2.1.514-2.el7 |
rh-dotnet21-dotnet-debuginfoRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.514-2.el7 | 0:2.1.514-2.el7 |
rh-dotnet21-dotnet-hostRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.18-2.el7 | 0:2.1.18-2.el7 |
rh-dotnet21-dotnet-runtime-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.18-2.el7 | 0:2.1.18-2.el7 |
rh-dotnet21-dotnet-sdk-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.514-2.el7 | 0:2.1.514-2.el7 |
rh-dotnet21-dotnet-sdk-2.1.5xxRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.514-2.el7 | 0:2.1.514-2.el7 |
rh-dotnet21-runtimeRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-17.el7 | 0:2.1-17.el7 |
rh-dotnet31-aspnetcore-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-aspnetcore-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnetRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-dotnet-apphost-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-debuginfoRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-dotnet-hostRed Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-hostfxr-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-sdk-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-dotnet-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.4-2.el7 | 0:3.1.4-2.el7 |
rh-dotnet31-dotnet-templates-3.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
rh-dotnet31-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.1::el7 From an advisory covering 2 CVEs |
before 0:3.1.104-2.el7 | 0:3.1.104-2.el7 |
aspnetcore-runtime-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
aspnetcore-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnetRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet-apphost-pack-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-apphost-pack-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-hostRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-host-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-hostfxr-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-hostfxr-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-runtime-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-runtime-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-sdk-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet-sdk-3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.4-2.el8_2 | 0:3.1.4-2.el8_2 |
dotnet-templates-3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet3.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet3.1-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
dotnet3.1-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:3.1.104-2.el8_2 | 0:3.1.104-2.el8_2 |
aspnetcore-runtime-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
aspnetcore-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnetRed Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnet-apphost-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-apphost-pack-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-hostRed Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-host-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-hostfxr-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-hostfxr-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-runtime-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-runtime-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-sdk-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnet-sdk-3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnet-targeting-pack-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.5-2.el8_2 | 0:3.1.5-2.el8_2 |
dotnet-templates-3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnet3.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnet3.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnet3.1-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:8::appstream |
before 0:3.1.105-2.el8_2 | 0:3.1.105-2.el8_2 |
dotnetRed Hat:enterprise_linux:8::appstream |
before 0:2.1.515-1.el8_2 | 0:2.1.515-1.el8_2 |
dotnet-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.515-1.el8_2 | 0:2.1.515-1.el8_2 |
dotnet-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.1.515-1.el8_2 | 0:2.1.515-1.el8_2 |
dotnet-host-fxr-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.19-1.el8_2 | 0:2.1.19-1.el8_2 |
dotnet-host-fxr-2.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.19-1.el8_2 | 0:2.1.19-1.el8_2 |
dotnet-runtime-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.19-1.el8_2 | 0:2.1.19-1.el8_2 |
dotnet-runtime-2.1-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.19-1.el8_2 | 0:2.1.19-1.el8_2 |
dotnet-sdk-2.1Red Hat:enterprise_linux:8::appstream |
before 0:2.1.515-1.el8_2 | 0:2.1.515-1.el8_2 |
dotnet-sdk-2.1.5xxRed Hat:enterprise_linux:8::appstream |
before 0:2.1.515-1.el8_2 | 0:2.1.515-1.el8_2 |
dotnet-sdk-2.1.5xx-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.515-1.el8_2 | 0:2.1.515-1.el8_2 |
rh-dotnet31-aspnetcore-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-aspnetcore-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-dotnetRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.105-1.el7 | 0:3.1.105-1.el7 |
rh-dotnet31-dotnet-apphost-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-dotnet-debuginfoRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.105-1.el7 | 0:3.1.105-1.el7 |
rh-dotnet31-dotnet-hostRed Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-dotnet-hostfxr-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-dotnet-runtime-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-dotnet-sdk-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.105-1.el7 | 0:3.1.105-1.el7 |
rh-dotnet31-dotnet-targeting-pack-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.5-1.el7 | 0:3.1.5-1.el7 |
rh-dotnet31-dotnet-templates-3.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.105-1.el7 | 0:3.1.105-1.el7 |
rh-dotnet31-netstandard-targeting-pack-2.1Red Hat:rhel_dotnet:3.1::el7 |
before 0:3.1.105-1.el7 | 0:3.1.105-1.el7 |
rh-dotnet21Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-18.el7 | 0:2.1-18.el7 |
rh-dotnet21-dotnetRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.515-1.el7 | 0:2.1.515-1.el7 |
rh-dotnet21-dotnet-debuginfoRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.515-1.el7 | 0:2.1.515-1.el7 |
rh-dotnet21-dotnet-hostRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.19-1.el7 | 0:2.1.19-1.el7 |
rh-dotnet21-dotnet-runtime-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.19-1.el7 | 0:2.1.19-1.el7 |
rh-dotnet21-dotnet-sdk-2.1Red Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.515-1.el7 | 0:2.1.515-1.el7 |
rh-dotnet21-dotnet-sdk-2.1.5xxRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1.515-1.el7 | 0:2.1.515-1.el7 |
rh-dotnet21-runtimeRed Hat:rhel_dotnet:2.1::el7 |
before 0:2.1-18.el7 | 0:2.1-18.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1108 is a high vulnerability (CVSS 7.5) in Microsoft .net, published May 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.46%, the 93rd percentile. Fixed in Microsoft.NETCore.App 2.1.18.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1108
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1108
nvd.nist.gov/vuln/detail/CVE-2020-1108
github.com/dotnet/announcements/issues/157
access.redhat.com/errata/RHSA-2020:2143
Show 24 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1827643
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2143.json
cve.org/CVERecord?id=CVE-2020-1108