Bug 1513363 (CVE-2017-11883)

Summary:	CVE-2017-11883 ASP.NET Core: DoS due to improper handling of web requests
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-12-01 12:10:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1513364

Description Adam Mariš 2017-11-15 09:53:04 UTC

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".

External References:

https://github.com/aspnet/announcements/issues/278

Comment 1 Tomas Hoger 2017-12-01 12:10:16 UTC

This is an ASP.NET Core issue rather than .NET Core issues.  Upstream / Microsoft advisories provide more details:

https://github.com/aspnet/announcements/issues/278
https://github.com/aspnet/HttpSysServer/issues/416
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11883