{"id":"CVE-2019-0757","aliases":["EUVD-2019-1516","GHSA-c2wg-p84q-4x76","RHSA-2019:0544","RHSA-2019:1259"],"status":"published","title":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow...","description":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02696,"percentile":0.86009,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-04-09T01:51:25Z","modified":"2026-10-24T10:30:34Z","fixes":[{"ecosystem":"Red Hat:rhel_dotnet:1.0::el7","package":"rh-dotnetcore10-dotnetcore","fixed_in":["0:1.0.15-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:1.0::el7","package":"rh-dotnetcore10-dotnetcore-debuginfo","fixed_in":["0:1.0.15-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:1.1::el7","package":"rh-dotnetcore11-dotnetcore","fixed_in":["0:1.1.12-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:1.1::el7","package":"rh-dotnetcore11-dotnetcore-debuginfo","fixed_in":["0:1.1.12-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21","fixed_in":["0:2.1-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet","fixed_in":["0:2.1.505-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-debuginfo","fixed_in":["0:2.1.505-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-host","fixed_in":["0:2.1.9-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-runtime-2.1","fixed_in":["0:2.1.9-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1","fixed_in":["0:2.1.505-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1.5xx","fixed_in":["0:2.1.505-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-runtime","fixed_in":["0:2.1-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22","fixed_in":["0:2.2-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet","fixed_in":["0:2.2.105-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-debuginfo","fixed_in":["0:2.2.105-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host","fixed_in":["0:2.2.3-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host-fxr-2.2","fixed_in":["0:2.2.3-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-runtime-2.2","fixed_in":["0:2.2.3-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2","fixed_in":["0:2.2.105-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2.1xx","fixed_in":["0:2.2.105-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-runtime","fixed_in":["0:2.2-4.el7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:1.0::el7","package":"rh-dotnetcore10-dotnetcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.15-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:1.0::el7","package":"rh-dotnetcore10-dotnetcore-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.15-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:1.1::el7","package":"rh-dotnetcore11-dotnetcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.12-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:1.1::el7","package":"rh-dotnetcore11-dotnetcore-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.12-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.505-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.505-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-runtime-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.505-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-dotnet-sdk-2.1.5xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.505-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.1::el7","package":"rh-dotnet21-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.105-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.105-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-host-fxr-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-runtime-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.105-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-dotnet-sdk-2.2.1xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.105-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:2.2::el7","package":"rh-dotnet22-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.507-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.507-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.507-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-fxr-2.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-2.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.507-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.507-2.el8_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-2.1.5xx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.507-2.el8_0"}]}],"bundled":4}],"products":[{"vendor":"microsoft","product":".net core sdk"},{"vendor":"microsoft","product":".net_core_sdk"},{"vendor":"microsoft","product":"microsoft visual studio"},{"vendor":"microsoft","product":"mono framework"},{"vendor":"microsoft","product":"nuget"},{"vendor":"microsoft","product":"visual_studio_2017"},{"vendor":"mono-project","product":"mono_framework"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","article"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1259","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0757","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c2wg-p84q-4x76"},{"url":"https://access.redhat.com/errata/RHSA-2019:0544","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685720","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0544.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0757","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0820","tags":["article"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980","tags":["article"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981","tags":["article"]},{"url":"https://github.com/dotnet/core/blob/master/release-notes/2.1/2.1.11/2.1.11.md","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712471","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1259.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0820","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0980","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0980","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0980","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0981","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-0757","description":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.","status":"published","published":"2019-04-09T01:51:25Z","modified":"2024-08-04T17:58:59.044Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-1516","description":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.","status":"published","published":"2019-04-09T01:51:25Z","modified":"2024-08-04T17:58:59Z","updated_at":"2026-11-03T03:07:00.558698Z"}],"ghsa":[{"id":"GHSA-c2wg-p84q-4x76","title":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow...","description":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.","status":"published","published":"2022-05-13T01:02:36Z","modified":"2023-02-01T05:02:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:49:55.565803Z"}],"nvd":[{"id":"CVE-2019-0757","description":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.","status":"published","published":"2019-04-09T02:29:00.6Z","modified":"2026-06-17T02:08:50.58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-0757","description":"A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.","status":"published","published":"2019-04-09T02:29:00.6Z","modified":"2026-10-24T10:30:34.104110281Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"RHSA-2019:0544","title":"Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update for March 2019","status":"published","published":"2024-09-13T19:49:55Z","modified":"2026-06-28T10:28:44Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1259","title":"Red Hat Security Advisory: dotnet security, bug fix, and enhancement update","status":"published","published":"2024-09-13T19:50:54Z","modified":"2026-06-28T10:29:55Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}