CVE-2019-0757 Path traversal in .NET Core SDK
An authenticated attacker can tamper with NuGet package folder structures, potentially altering package contents or behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-0757?
CVE-2019-0757 is a medium-severity path traversal vulnerability in Microsoft Visual Studio 2017, published on 9 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.
Which versions are affected by CVE-2019-0757?
It affects 8 products.
Linux distribution packages (21)
rh-dotnetcore10-dotnetcore Red Hat:rhel_dotnet:1.0::el7 | All versions | 0:1.0.15-1.el7 |
rh-dotnetcore10-dotnetcore-debuginfo Red Hat:rhel_dotnet:1.0::el7 | All versions | 0:1.0.15-1.el7 |
rh-dotnetcore11-dotnetcore Red Hat:rhel_dotnet:1.1::el7 | All versions | 0:1.1.12-1.el7 |
rh-dotnetcore11-dotnetcore-debuginfo Red Hat:rhel_dotnet:1.1::el7 | All versions | 0:1.1.12-1.el7 |
rh-dotnet21 Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1-8.el7 |
rh-dotnet21-dotnet Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1.505-1.el7 |
rh-dotnet21-dotnet-debuginfo Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1.505-1.el7 |
rh-dotnet21-dotnet-host Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1.9-1.el7 |
rh-dotnet21-dotnet-runtime-2.1 Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1.9-1.el7 |
rh-dotnet21-dotnet-sdk-2.1 Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1.505-1.el7 |
rh-dotnet21-dotnet-sdk-2.1.5xx Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1.505-1.el7 |
rh-dotnet21-runtime Red Hat:rhel_dotnet:2.1::el7 | All versions | 0:2.1-8.el7 |
rh-dotnet22 Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2-4.el7 |
rh-dotnet22-dotnet Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.105-1.el7 |
rh-dotnet22-dotnet-debuginfo Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.105-1.el7 |
rh-dotnet22-dotnet-host Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.3-1.el7 |
rh-dotnet22-dotnet-host-fxr-2.2 Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.3-1.el7 |
rh-dotnet22-dotnet-runtime-2.2 Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.3-1.el7 |
rh-dotnet22-dotnet-sdk-2.2 Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.105-1.el7 |
rh-dotnet22-dotnet-sdk-2.2.1xx Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2.105-1.el7 |
rh-dotnet22-runtime Red Hat:rhel_dotnet:2.2::el7 | All versions | 0:2.2-4.el7 |
Products include Microsoft .Net Core Sdk, Microsoft Nuget, Microsoft Visual Studio 2017, Mono-Project Mono Framework, Redhat Enterprise Linux, Redhat Enterprise Linux Eus and 2 more.
How do I fix CVE-2019-0757?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-0757 being exploited?
There is no known exploitation of CVE-2019-0757 in the wild and no public exploit code.
Sources
Also known as GHSA-c2wg-p84q-4x76, RHSA-2019:0544.