CVE-2017-0247: Microsoft asp.net model view controller improper input validation vulnerability

Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

18 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Asp.Net Model View Controller Microsoft Microsoft.Aspnetcore.Mvc.Abstractions Microsoft Microsoft.Aspnetcore.Mvc.Apiexplorer Microsoft Microsoft.Aspnetcore.Mvc.Cors Microsoft Microsoft.Aspnetcore.Mvc.Dataannotations Microsoft Microsoft.Aspnetcore.Mvc.Formatters.Json Microsoft Microsoft.Aspnetcore.Mvc.Formatters.Xml Microsoft Microsoft.Aspnetcore.Mvc.Localization Microsoft Microsoft.Aspnetcore.Mvc.Razor Microsoft Microsoft.Aspnetcore.Mvc.Razor.Host Microsoft Microsoft.Aspnetcore.Mvc.Taghelpers Microsoft Microsoft.Aspnetcore.Mvc.Viewfeatures Microsoft Microsoft.Aspnetcore.Mvc.Webapicompatshim Microsoft System.Net.Http Microsoft System.Net.Http.Winhttphandler Microsoft System.Net.Security Microsoft System.Net.Websockets.Client Microsoft System.Text.Encodings.Web Microsoft

References

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.