CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.4epss 0.1%
probabilidad de explotación
0.1%top 99% de las CVE
explotación observada
noninguna fuente lo reporta
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
CoreWCF · CoreWCFReferencias
https://github.com/CoreWCF/CoreWCF/commit/994431268e3362c0cd126450fe2a135c202551f3https://github.com/CoreWCF/CoreWCF/commit/9af16955e51a57348dafce0019e259a092ef7440https://github.com/CoreWCF/CoreWCF/commit/f2f1a05927a88b8a75fa0582fa8ed75eb891e463https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-wjpq-6766-7f5j