certfr-2019-avi-437 — De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un at…

certfr-2019-avi-437

EUVD-2026-49100

fkie_cve-2019-1301

A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.

GHSA-62gw-3rmj-wmp2 — High severity vulnerability that affects System.Management.Automation

Affected: NuGet: System.Management.Automation

# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core

## Executive Summary

A denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.

The update addresses the vulnerability by correcting how the .NET Core handles web requests.

System administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)

## Discussion

Please [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=&labels=Issue-Question&template=Support_Question.md&title=Support+Question) to discussion the PowerShell aspects of this advisory. Please use dotnet/announcements#121 for discussion of the .NET aspects this advisory.

## <a name="affected-software">Affected Software</a>

The vulnerability affects PowerShell Core prior to the following versions:

| PowerShell Core Version | Fixed in | |-------------------------|-------------------| | 6.1 | 6.1.6 | | 6.2 | 6.2.3 | | 7.0 | unaffected | |5 | unaffected |

## Advisory FAQ

### How do I know if I am affected?

If all of the following are true:

1. Run `pwsh -v`, then, check the version in the table in [Affec…

RHSA-2019:2731 — Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update

dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service

RHSA-2019:2732 — Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security and bug fix update