{"id":"GHSA-6xh7-4v2w-36q6","summary":"ASP.NET Core fails to properly validate web requests","details":"A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.","aliases":["CVE-2017-0247"],"modified":"2023-11-08T03:58:40.064574Z","published":"2018-10-16T19:58:05Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:20:41Z","nvd_published_at":"2017-05-12T14:29:00Z","cwe_ids":["CWE-20"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0247"},{"type":"WEB","url":"https://github.com/aspnet/Announcements/issues/239"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6xh7-4v2w-36q6"},{"type":"WEB","url":"https://technet.microsoft.com/en-us/library/security/4021279.aspx"},{"type":"WEB","url":"https://www.sidertia.com/Home/Community/Blog/2017/05/18/ASPNET-Core-Unicode-Non-Char-Encoding-DoS"}],"affected":[{"package":{"name":"Microsoft.AspNetCore.Mvc","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Core","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Core","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.1"},{"fixed":"4.1.2"}]}],"versions":["4.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1"},{"fixed":"4.3.2"}]}],"versions":["4.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Text.Encodings.Web","ecosystem":"NuGet","purl":"pkg:nuget/System.Text.Encodings.Web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Text.Encodings.Web","ecosystem":"NuGet","purl":"pkg:nuget/System.Text.Encodings.Web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.Http.WinHttpHandler","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.Http.WinHttpHandler"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.Http.WinHttpHandler","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.Http.WinHttpHandler"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.5.4"}]}],"versions":["4.3.0","4.3.1","4.3.2","4.3.3","4.4.0","4.4.0-preview1-25305-02","4.4.0-preview2-25405-01","4.5.0","4.5.0-preview1-26216-02","4.5.0-preview2-26406-04","4.5.0-rc1","4.5.1","4.5.2","4.5.2-servicing-27114-05","4.5.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.WebSockets.Client","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.WebSockets.Client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"System.Net.WebSockets.Client","ecosystem":"NuGet","purl":"pkg:nuget/System.Net.WebSockets.Client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Abstractions","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Abstractions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Abstractions","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Abstractions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.ApiExplorer","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.ApiExplorer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.ApiExplorer","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.ApiExplorer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Cors","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Cors"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Cors","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Cors"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.DataAnnotations","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.DataAnnotations"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.DataAnnotations","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.DataAnnotations"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Formatters.Json","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Formatters.Json"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Formatters.Json","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Formatters.Json"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Formatters.Xml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Formatters.Xml","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Formatters.Xml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Localization","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Localization"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Localization","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Localization"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Razor.Host","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Razor.Host"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Razor.Host","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Razor.Host"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Razor","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Razor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.Razor","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.Razor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.TagHelpers","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.TagHelpers"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.TagHelpers","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.TagHelpers"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.ViewFeatures","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.ViewFeatures"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.ViewFeatures","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.ViewFeatures"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.WebApiCompatShim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}},{"package":{"name":"Microsoft.AspNetCore.Mvc.WebApiCompatShim","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Mvc.WebApiCompatShim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]}],"versions":["1.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6xh7-4v2w-36q6/GHSA-6xh7-4v2w-36q6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}