CVE-2018-0875

{"containers": {"cna": {"affected": [{"product": ".NET Core", "vendor": "Microsoft Corporation", "versions": [{"status": "affected", "version": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\"."}]}], "datePublic": "2018-03-14T00:00:00.000Z", "descriptions": [{"lang": "en", "value": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\"."}], "problemTypes": [{"descriptions": [{"description": "Denial of Service", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-03-15T09:57:02.000Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875"}, {"name": "103225", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103225"}, {"name": "1040505", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040505"}, {"name": "RHSA-2018:0522", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0522"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "DATE_PUBLIC": "2018-03-14T00:00:00", "ID": "CVE-2018-0875", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": ".NET Core", "version": {"version_data": [{"version_value": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\"."}]}}]}, "vendor_name": "Microsoft Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\"."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Denial of Service"}]}]}, "references": {"reference_data": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875"}, {"name": "103225", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103225"}, {"name": "1040505", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040505"}, {"name": "RHSA-2018:0522", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0522"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:44:11.381Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875"}, {"name": "103225", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103225"}, {"name": "1040505", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1040505"}, {"name": "RHSA-2018:0522", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0522"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2018-0875", "datePublished": "2018-03-14T17:00:00.000Z", "dateReserved": "2017-12-01T00:00:00.000Z", "dateUpdated": "2024-09-16T17:33:24.246Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": ".NET Core", "vendor": "Microsoft Corporation", "versions": [{"status": "affected", "version": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\"."}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0913F82A-985A-401D-89F6-191684A8AB55", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8256236D-D4F0-4207-B82D-18B0135CEB4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "345222C2-CD5B-4613-9FF3-9D034974D54F", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:powershell_core:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2D6A900C-6173-466A-B54D-683A12F53138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\"."}, {"lang": "es", "value": ".NET Core 1.0, .NET Core 1.1, NET Core 2.0 y PowerShell Core 6.0.0 permiten una vulnerabilidad de denegaci\u00f3n de servicio (DoS) debido a la forma en la que se gestionan las peticiones especialmente manipuladas. Esto tambi\u00e9n se conoce como \".NET Core Denial of Service Vulnerability\"."}], "id": "CVE-2018-0875", "lastModified": "2026-06-17T01:31:50.700", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-14T17:29:00.980", "references": [{"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103225"}, {"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040505"}, {"source": "secure@microsoft.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0522"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103225"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040505"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0522"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0875"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Ben Adams (Illyriad Games) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnet20-dotnet-0:2.0.6-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.10-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:1.0::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.7-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnet20-dotnet-0:2.0.6-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.10-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:1.1::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.7-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:2.0::el7", "package": "rh-dotnet20-dotnet-0:2.0.6-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:2.0::el7", "package": "rh-dotnetcore10-dotnetcore-0:1.0.10-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}, {"advisory": "RHSA-2018:0522", "cpe": "cpe:/a:redhat:rhel_dotnet:2.0::el7", "package": "rh-dotnetcore11-dotnetcore-0:1.1.7-1.el7", "product_name": ".NET Core on Red Hat Enterprise Linux", "release_date": "2018-03-14T00:00:00Z"}], "bugzilla": {"description": "Core: Hash Collision Denial of Service", "id": "1552060", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1552060"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "verified"}, "details": [".NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka \".NET Core Denial of Service Vulnerability\".", "It was found that string comparisons in .NET Core did not use a secure hashing algorithm. This could allow an attacker to predict string hashes and cause a denial of service by intentionally creating collisions thus forcing long look up times."], "name": "CVE-2018-0875", "public_date": "2018-03-13T16:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-0875\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-0875"], "threat_severity": "Low"}

{}