Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

system.formats.asn1

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7NuGetPublished

    Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability

    CVE-2024-38095 · GHSA-447r-wph3-92pm

    Affected
    • NuGet system.formats.asn1 >= 5.0.0-preview.7.20364.11, < 6.0.1; >= 7.0.0-preview.1.22076.8, < 8.0.1
    Fixed in
    8.0.16.0.1· Vendor fix available
    Issue
    Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Vulnerability exists when System.Formats.Asn1 in .NET parses an X.509 certificate or collection of certificates, a malicious certificate can result in excessive CPU consumption on all platforms result in Denial of Service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/312 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 6.0 application running on .NET 6.0.31 or earlier. Any .NET 8.0 application running on .NET 8.0.6 or earlier. <a…

    Recommended action: Upgrade to 8.0.1 or 6.0.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →