CVE-2018-8269 Denial of service in ASP.NET Core
An attacker can cause a denial of service by sending improperly handled web requests to applications using the Microsoft OData library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8269?
CVE-2018-8269 is a high-severity denial of service vulnerability in Microsoft.Data.OData, published on 13 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." This affects Microsoft.Data.OData.
Which versions are affected by CVE-2018-8269?
10 open source packages ship an affected version, including Microsoft.Data.OData, Microsoft.AspNetCore.All and Microsoft.AspNetCore.DataProtection.AzureStorage. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.Data.OData NuGet | All versions | 5.8.4 |
Microsoft.Data.OData NuGet | All versions | 5.8.4 |
Microsoft.AspNetCore.All NuGet | From 2.1.0 | 2.1.13 |
Microsoft.AspNetCore.All NuGet | From 2.1.0 | 2.1.13 |
Microsoft.AspNetCore.All NuGet | From 2.2.0 | 2.2.7 |
Microsoft.AspNetCore.All NuGet | From 2.2.0 | 2.2.7 |
4 more packages
Microsoft.AspNetCore.DataProtection.AzureStorage NuGet | From 2.1.0 | 2.1.13 |
Microsoft.AspNetCore.DataProtection.AzureStorage NuGet | From 2.1.0 | 2.1.13 |
Microsoft.AspNetCore.DataProtection.AzureStorage NuGet | From 2.2.0 | 2.2.7 |
Microsoft.AspNetCore.DataProtection.AzureStorage NuGet | From 2.2.0 | 2.2.7 |
Products include Microsoft Microsoft.data.odata.
How do I fix CVE-2018-8269?
Upgrade Microsoft.Data.OData to 5.8.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-8269 being exploited?
There is no known exploitation of CVE-2018-8269 in the wild and no public exploit code.
Public exploit code: 2 Exploit-DB entries.
Sources
Also known as GHSA-mv2r-q4g5-j8q5.