Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
15 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.0.0-rc.210.0.138.0.59.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/489 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. KeyInfoX509Data can accept serialized certificate formats containing attacker-controlled chain metadata instead of requiring a plain X.509 certificate, contributing to certificate-forgery and token-spoofing paths. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/474 CVSS Details - Version: 3.1 - Severity: High - Score: 7.4 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness: CWE-295 (Improper Certificate Validation) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name |…
Recommended action: Upgrade to 8.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.59.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/490 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-405 (Asymmetric Resource Consumption (Amplification)) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.59.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/488 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-407 (Inefficient Algorithmic Complexity) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where a buffer overflow can give an attacker to the ability to perform a Denial of Service attack. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/391 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H E:U/RL:O/RC:C - Weakness: CWE-121 CWE-20: Stack-based Buffer Overflow Improper Input Validation Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected…
Recommended action: Upgrade to 10.0.6, 9.0.15 or 8.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML that is improperly validated, resulting in denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/416 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-121 (Stack-based Buffer Overflow) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML that causes uncontrolled resource consumption, resulting in denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/414 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML that causes uncontrolled resource consumption, resulting in denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/416 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability to bypass encryption protections and access encrypted data. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/412. CVSS Details - Version: 3.1 - Severity: High - Score: 8.1 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-347 (Improper Verification of Cryptographic Signature) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where uncontrolled resource consumption can give an attacker to the ability to perform a Denial of Service attack. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/389 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H E:U/RL:O/RC:C - Weakness: CWE-400 CWE-611: Uncontrolled Resource Consumption Improper Restriction of XML External Entity Reference Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below <a…
Recommended action: Upgrade to 10.0.6, 9.0.15 or 8.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/392 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: 7.5 CVSS: 3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-835 CWE-400 CWE-20: Loop with Unreachable Exit Condition ('Infinite Loop') Uncontrolled Resource Consumption Improper Input Validation Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed…
Recommended action: Upgrade to 10.0.6, 9.0.15 or 8.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information. <a name="affected-software"</aAffected software Any .NET 6.0 application running on .NET 6.0.7 or earlier. Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. <a name=".NET Core 3.1"</a.NET Core 3.1 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- System.Security.Cryptography.Xml| <=4.7.0| 4.7.1 Microsoft.AspNetCore.App.Runtime.win-x64| =3.1.0, 3.1.27| 3.1.28 Microsoft.AspNetCore.App.Runtime.linux-x64| =3.1.0, 3.1.27|…
Recommended action: Upgrade to 6.0.1 or 4.7.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.
Recommended action: Upgrade to 4.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
Recommended action: Upgrade to 4.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.