GHSA-p9wx-v264-q34p
Improper Certificate Validation in Microsoft .NET Framework components
Quick fix
GHSA-p9wx-v264-q34p — System.Private.ServiceModel: upgrade to the fixed version with the command below.
dotnet add package System.Private.ServiceModel --version 4.1.3Details
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.
Are you affected?
Enter the version of the package you're using.
Affected packages
4.0.0Fixed in: 4.1.3dotnet add package System.Private.ServiceModel --version 4.1.34.3.0Fixed in: 4.3.3dotnet add package System.Private.ServiceModel --version 4.3.34.4.0Fixed in: 4.4.4dotnet add package System.Private.ServiceModel --version 4.4.44.5.0Fixed in: 4.5.3dotnet add package System.Private.ServiceModel --version 4.5.34.3.0Fixed in: 4.3.3dotnet add package System.ServiceModel.Duplex --version 4.3.34.4.0Fixed in: 4.4.4dotnet add package System.ServiceModel.Duplex --version 4.4.44.5.0Fixed in: 4.5.3dotnet add package System.ServiceModel.Duplex --version 4.5.34.0.0Fixed in: 4.0.4dotnet add package System.ServiceModel.Duplex --version 4.0.44.3.0Fixed in: 4.3.3dotnet add package System.ServiceModel.Http --version 4.3.34.4.0Fixed in: 4.4.4dotnet add package System.ServiceModel.Http --version 4.4.44.5.0Fixed in: 4.5.3dotnet add package System.ServiceModel.Http --version 4.5.34.0.0Fixed in: 4.1.3dotnet add package System.ServiceModel.Http --version 4.1.34.3.0Fixed in: 4.3.3dotnet add package System.ServiceModel.NetTcp --version 4.3.34.4.0Fixed in: 4.4.4dotnet add package System.ServiceModel.NetTcp --version 4.4.44.5.0Fixed in: 4.5.3dotnet add package System.ServiceModel.NetTcp --version 4.5.34.0.0Fixed in: 4.1.3dotnet add package System.ServiceModel.NetTcp --version 4.1.34.3.0Fixed in: 4.3.3dotnet add package System.ServiceModel.Primitives --version 4.3.34.4.0Fixed in: 4.4.4dotnet add package System.ServiceModel.Primitives --version 4.4.44.5.0Fixed in: 4.5.3dotnet add package System.ServiceModel.Primitives --version 4.5.34.0.0Fixed in: 4.1.3dotnet add package System.ServiceModel.Primitives --version 4.1.34.3.0Fixed in: 4.3.3dotnet add package System.ServiceModel.Security --version 4.3.34.4.0Fixed in: 4.4.4dotnet add package System.ServiceModel.Security --version 4.4.44.5.0Fixed in: 4.5.3dotnet add package System.ServiceModel.Security --version 4.5.34.0.0Fixed in: 4.0.4dotnet add package System.ServiceModel.Security --version 4.0.4