Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CoreWCF NetFraming based services can leave connections open when they should be closed
Vulnerability Description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
不恰当的资源关闭或释放
Vulnerability Title
CoreWCF 安全漏洞
Vulnerability Description
CoreWCF是CoreWCF项目的一个开源项目，旨在为 .NET Core 和 .NET 5+ 提供 WCF（Windows Communication Foundation）的替代实现。 CoreWCF 1.4.1版本和1.5.1版本存在安全漏洞，该漏洞源于基于CoreWCF NetFraming的服务可以在连接应该关闭时保持连接打开的状态。
CVSS Information
N/A
Vulnerability Type
N/A