CVE-2020-0603
Fixed in a distro release EPSS 21%
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
Products: Microsoft ASP.NET Core
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.AspNetCore.All | 2.1.15 |
| NuGet | Microsoft.AspNetCore.App | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App | 3.0.1 |
| NuGet | Microsoft.AspNetCore.App | 2.1.15 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-arm | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-arm64 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-x64 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.osx-x64 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-arm | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-x64 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-x86 | 3.1.1 |
| NuGet | Microsoft.AspNetCore.Http.Connections | 1.0.15 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8 | aspnetcore-runtime-3.0 | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | aspnetcore-targeting-pack-3.0 | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-3.0 | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-3.0-debuginfo | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-host | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-host-debuginfo | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-3.0 | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-3.0-debuginfo | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-3.0 | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-3.0-debuginfo | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-3.0 | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-3.0-debuginfo | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-targeting-pack-3.0 | 0:3.0.2-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet-templates-3.0 | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet3.0 | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet3.0-debuginfo | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | dotnet3.0-debugsource | 0:3.0.102-2.el8_1 |
| Red Hat Enterprise Linux 8 | netstandard-targeting-pack-2.1 | 0:3.0.102-2.el8_1 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-aspnetcore-runtime-3.0 | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-aspnetcore-targeting-pack-3.0 | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet | 0:3.0.102-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-apphost-pack-3.0 | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-debuginfo | 0:3.0.102-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-host | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-hostfxr-3.0 | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-runtime-3.0 | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-sdk-3.0 | 0:3.0.102-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-targeting-pack-3.0 | 0:3.0.2-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-dotnet-templates-3.0 | 0:3.0.102-3.el7 |
| Red Hat rhel dotnet 3.0 | rh-dotnet30-netstandard-targeting-pack-2.1 | 0:3.0.102-3.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-aspnetcore-runtime-3.1 | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-aspnetcore-targeting-pack-3.1 | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet | 0:3.1.101-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-apphost-pack-3.1 | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-debuginfo | 0:3.1.101-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-host | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-hostfxr-3.1 | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-runtime-3.1 | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-sdk-3.1 | 0:3.1.101-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-targeting-pack-3.1 | 0:3.1.1-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-templates-3.1 | 0:3.1.101-4.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-netstandard-targeting-pack-2.1 | 0:3.1.101-4.el7 |