cube-soft / cube.net Goto Github PK

Vulnerable Library - system.private.uri.4.3.0.nupkg

Internal implementation package not meant for direct consumption. Please do not reference directly....

Library home page: https://api.nuget.org/packages/system.private.uri.4.3.0.nupkg

Path to vulnerable library: /packages/system.private.uri/4.3.0/system.private.uri.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.private.uri.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Publish Date: 2019-03-05

URL: CVE-2019-0657

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/dotnet/corefx/issues/35265

Release Date: 2018-11-26

Fix Resolution: Microsoft.NETCore.App.nupkg - 2.1.8,2.2.2;System.Private.Uri.nupkg - 4.3.1

Vulnerable Library - opencover.4.7.922.nupkg

An open source code coverage tool (branch and sequence point) for all .NET Frameworks 2 and above. A...

Library home page: https://api.nuget.org/packages/opencover.4.7.922.nupkg

Path to dependency file: /tmp/ws-scm/Cube.Net/Libraries/Tests/Cube.Net.Tests.csproj

Path to vulnerable library: /Cube.Net/Libraries/Tests/Cube.Net.Tests.csproj,/Cube.Net/Applications/Rss/Tests/Cube.Net.Rss.Tests.csproj

Dependency Hierarchy:

• ❌ opencover.4.7.922.nupkg (Vulnerable Library)

Found in HEAD commit: 4f39b4d65d4a8fa22353ba81f4ac1fd44113e3b4

Vulnerability Details

Apache log4net before 2.0.8 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.

Publish Date: 2020-05-11

URL: CVE-2018-1285

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/LOG4NET-575

Release Date: 2020-05-11

Fix Resolution: log4net - 2.1.0

Vulnerable Library - system.private.uri.4.3.0.nupkg

Internal implementation package not meant for direct consumption. Please do not reference directly....

Library home page: https://api.nuget.org/packages/system.private.uri.4.3.0.nupkg

Path to vulnerable library: /packages/system.private.uri/4.3.0/system.private.uri.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.private.uri.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0980

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980

Release Date: 2019-05-16

Fix Resolution: 4.3.2

Vulnerable Library - system.text.regularexpressions.4.1.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.1.0.nupkg

Path to dependency file: Cube.Net/Tests/Core/Cube.Net.Tests.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.1.0/system.text.regularexpressions.4.1.0.nupkg

Dependency Hierarchy:

• microsoft.testplatform.testhost.17.0.0.nupkg (Root Library)
  • newtonsoft.json.9.0.1.nupkg
    • ❌ system.text.regularexpressions.4.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2020-08-24

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Vulnerable Library - system.private.uri.4.3.0.nupkg

Internal implementation package not meant for direct consumption. Please do not reference directly....

Library home page: https://api.nuget.org/packages/system.private.uri.4.3.0.nupkg

Path to vulnerable library: /packages/system.private.uri/4.3.0/system.private.uri.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.private.uri.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.

Publish Date: 2019-05-16

URL: CVE-2019-0981

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981

Release Date: 2019-05-16

Fix Resolution: 4.3.2