漏洞标题
基于NetFraming的CoreWCF 服务在本应关闭时,可能会让连接保持打开状态
漏洞描述信息
CoreWCF是Windows Communication Foundation（WCF）服务端的一个.NET Core移植版本。如果你的CoreWCF服务基于NetFraming，那么可能会因为连接没有正确关闭而导致额外的系统资源消耗。这种情况可能发生于两种场景：当客户端与服务建立连接并发送无数据时，服务会无限期地等待客户端发起NetFraming会话握手。此外，一旦客户端建立了会话，如果在绑定的接收超时时期内（例如NetTcpBinding中的ReceiveTimeout），客户端没有发送任何请求，那么连接不会作为会话中止的一部分而正确关闭。受到影响的绑定包括NetTcpBinding、NetNamedPipeBinding和UnixDomainSocketBinding。其中只有NetTcpBinding有能力接受非本地连接。目前CoreWCF支持的版本为v1.4.x和v1.5.x。这个问题的修复可以在v1.4.2和v1.5.3的CoreWCF包中找到。建议用户升级。对于这个问题，没有工作绕行方法。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
未加控制的资源消耗(资源穷尽)
漏洞标题
CoreWCF NetFraming based services can leave connections open when they should be closed
漏洞描述信息
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
不恰当的资源关闭或释放
漏洞标题
CoreWCF 安全漏洞
漏洞描述信息
CoreWCF是CoreWCF项目的一个开源项目，旨在为 .NET Core 和 .NET 5+ 提供 WCF（Windows Communication Foundation）的替代实现。 CoreWCF 1.4.1版本和1.5.1版本存在安全漏洞，该漏洞源于基于CoreWCF NetFraming的服务可以在连接应该关闭时保持连接打开的状态。
CVSS信息
N/A
漏洞类别
其他