{"id":"GHSA-p9wx-v264-q34p","summary":"Improper Certificate Validation in Microsoft .NET Framework components","details":"A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka \".NET Framework Security Feature Bypass Vulnerability.\" This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.","aliases":["CVE-2018-8356"],"modified":"2023-11-01T04:49:39.848036Z","published":"2022-05-14T03:00:10Z","database_specific":{"nvd_published_at":"2018-07-11T00:29:00Z","cwe_ids":["CWE-295"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-07-08T19:23:06Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8356"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/73"},{"type":"WEB","url":"https://github.com/github/advisory-database/issues/302"},{"type":"WEB","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8356"}],"affected":[{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}],"versions":["4.0.0","4.0.1-beta-23225","4.0.1-beta-23409","4.1.0","4.1.0-beta-23516","4.1.0-rc2-24027","4.1.1","4.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["4.4.0","4.4.1","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.Private.ServiceModel","ecosystem":"NuGet","purl":"pkg:nuget/System.Private.ServiceModel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}],"versions":["4.5.0","4.5.1","4.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["4.4.0","4.4.1","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}],"versions":["4.5.0","4.5.1","4.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Duplex","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Duplex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}],"versions":["4.0.0","4.0.1","4.0.1-beta-23225","4.0.1-beta-23409","4.0.1-beta-23516","4.0.1-rc2-24027","4.0.2","4.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json","last_known_affected_version_range":"\u003c= 4.0.2"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["4.4.0","4.4.1","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}],"versions":["4.5.0","4.5.1","4.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Http","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}],"versions":["4.0.0","4.0.10","4.0.10-beta-22605","4.0.10-beta-22816","4.0.10-beta-23019","4.0.10-beta-23109","4.0.11-beta-23225","4.0.11-beta-23409","4.0.11-beta-23516","4.1.0","4.1.0-rc2-24027","4.1.1","4.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["4.4.0","4.4.1","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}],"versions":["4.5.0","4.5.1","4.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.NetTcp","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.NetTcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}],"versions":["4.0.0","4.0.1-beta-23225","4.0.1-beta-23409","4.1.0","4.1.0-beta-23516","4.1.0-rc2-24027","4.1.1","4.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["4.4.0","4.4.1","4.4.1-servicing-25917-01","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}],"versions":["4.5.0","4.5.1","4.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Primitives","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Primitives"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.3"}]}],"versions":["4.0.0","4.0.1-beta-23225","4.0.1-beta-23409","4.1.0","4.1.0-beta-23516","4.1.0-rc2-24027","4.1.1","4.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["4.4.0","4.4.1","4.4.2","4.4.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}],"versions":["4.5.0","4.5.1","4.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}},{"package":{"name":"System.ServiceModel.Security","ecosystem":"NuGet","purl":"pkg:nuget/System.ServiceModel.Security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}],"versions":["4.0.0","4.0.1","4.0.1-beta-23225","4.0.1-beta-23409","4.0.1-beta-23516","4.0.1-rc2-24027","4.0.2","4.0.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 4.0.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p9wx-v264-q34p/GHSA-p9wx-v264-q34p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}