CVE-2020-1045
Fixed in a distro release EPSS 6%CVSS 7.5
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>
Products: Microsoft ASP.NET Core 2.1, Microsoft ASP.NET Core 3.1
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.AspNetCore.App | 2.1.22 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-arm | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-arm64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.linux-x64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.osx-x64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-arm | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-arm64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-x64 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.App.Runtime.win-x86 | 3.1.8 |
| NuGet | Microsoft.AspNetCore.Http | 2.1.22 |
| NuGet | Microsoft.Owin | 4.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8 | aspnetcore-runtime-3.1 | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | aspnetcore-targeting-pack-3.1 | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-3.1 | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-3.1-debuginfo | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-host | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-host-debuginfo | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-3.1 | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-3.1-debuginfo | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-3.1 | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-3.1-debuginfo | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-3.1 | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-3.1-debuginfo | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-targeting-pack-3.1 | 0:3.1.8-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet-templates-3.1 | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet3.1 | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet3.1-debuginfo | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | dotnet3.1-debugsource | 0:3.1.108-2.el8_2 |
| Red Hat Enterprise Linux 8 | netstandard-targeting-pack-2.1 | 0:3.1.108-2.el8_2 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-aspnetcore-runtime-3.1 | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-aspnetcore-targeting-pack-3.1 | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet | 0:3.1.108-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-apphost-pack-3.1 | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-debuginfo | 0:3.1.108-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-host | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-hostfxr-3.1 | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-runtime-3.1 | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-sdk-3.1 | 0:3.1.108-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-targeting-pack-3.1 | 0:3.1.8-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-templates-3.1 | 0:3.1.108-1.el7 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-netstandard-targeting-pack-2.1 | 0:3.1.108-1.el7 |