<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p>
<p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p>
<p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
31 Dec 2023, 22:15
Type | Values Removed | Values Added |
---|---|---|
Summary | <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p> | |
References |
|
|
12 Dec 2022, 18:29
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* |
|
References | (MISC) https://security.snyk.io/vuln/SNYK-RHEL8-DOTNET-1439600 - Third Party Advisory | |
References | (MISC) https://access.redhat.com/errata/RHSA-2020:3699 - Third Party Advisory | |
References | (CONFIRM) https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md#changes-in-318 - Release Notes, Third Party Advisory |
23 Nov 2022, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
CPE | cpe:2.3:a:microsoft:asp.net_core:3.1:*:*:*:*:*:*:* |
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* |
02 Sep 2022, 15:34
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
|
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ASICXQXS4M7MTAF6SGQMCLCA63DLCUT3/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5LN2FUVBSVPGK7AU3NMLO3YR6CGONQPB/ - Mailing List, Third Party Advisory |
Information
Published : 2020-09-11 17:15
Updated : 2024-02-04 21:00
NVD link : CVE-2020-1045
Mitre link : CVE-2020-1045
CVE.ORG link : CVE-2020-1045
JSON object : View
Products Affected
redhat
- enterprise_linux_tus
- enterprise_linux_eus
- enterprise_linux_aus
- enterprise_linux
microsoft
- asp.net_core
fedoraproject
- fedora
CWE