Description (CNA)
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Microsoft / Microsoft Visual Studio | affected 2017 for Mac |
| Microsoft / .NET Core SDK | affected 1.1 on .NET Core 1.0; affected 2.1.500 on .NET Core 2.1; affected 2.2.100 on .NET Core 2.2; affected 1.1 on .NET Core 1.1 |
| Microsoft / Nuget | affected 4.3.1; affected 4.4.2; affected 4.5.2; affected 4.6.3; affected 4.7.2; affected 4.8.2; affected 4.9.4 |
| Microsoft / Mono Framework | affected 5.18.0.223; affected 5.20.0 |
CWE
No CWE identifiers supplied.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757
- https://access.redhat.com/errata/RHSA-2019:1259
ADP enrichment
No English description supplied.