{"id":"GHSA-jc8g-xhw5-6x46","summary":"Improper Certificate Validation in Microsoft .NET Framework components","details":"Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka \".NET Security Feature Bypass Vulnerability.\"","aliases":["CVE-2018-0786"],"modified":"2023-11-08T03:59:31.030847Z","published":"2018-10-16T19:59:05Z","database_specific":{"nvd_published_at":"2018-01-10T01:29:00Z","cwe_ids":["CWE-295"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:43:03Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0786"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/51"},{"type":"WEB","url":"https://github.com/github/advisory-database/issues/302"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jc8g-xhw5-6x46"},{"type":"WEB","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786"},{"type":"WEB","url":"https://www.nuget.org/packages/System.ServiceModel.Duplex#versions-body-tab"}],"affected":[{"package":{"name":"Microsoft.NETCore.UniversalWindowsPlatform","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.UniversalWindowsPlatform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"Microsoft.NETCore.UniversalWindowsPlatform","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.UniversalWindowsPlatform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.5"}]}],"versions":["5.3.0","5.3.1","5.3.2","5.3.3","5.3.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"Microsoft.NETCore.UniversalWindowsPlatform","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.UniversalWindowsPlatform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.2"}]}],"versions":["5.4.0","5.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"Microsoft.NETCore.UniversalWindowsPlatform","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.UniversalWindowsPlatform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.6"}]}],"versions":["6.0.1","6.0.2","6.0.4","6.0.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"versions":["4.4.0","4.4.1-servicing-25917-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"}]}],"versions":["4.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"versions":["4.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"}]}],"versions":["4.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"versions":["4.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"}]}],"versions":["4.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"versions":["4.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1"},{"fixed":"4.0.2"}]}],"versions":["4.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"versions":["4.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1"},{"fixed":"4.0.2"}]}],"versions":["4.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}],"versions":["4.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}},{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"}]}],"versions":["4.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jc8g-xhw5-6x46/GHSA-jc8g-xhw5-6x46.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}