CVE-2019-1075

[asmundg]

The NSwag.MBuild nuget (and possibly others) appear to bundle DLLs affected by CVE-2019-1075: ASP.NET Core Spoofing Vulnerability (aspnet/Announcements#373).

From the upstream bug:

"Microsoft is aware of a spoofing vulnerability that exists in ASP.NET Core that could lead to an open redirect. An attacker who successfully exploited the vulnerability could redirect a targeted user to a malicious website.

To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.

Affected software: Any ASP.NET Core based application that uses any of following vulnerable packages:

Package name	Vulnerable versions	Secure versions
Microsoft.AspNetCore.Server.HttpSys	2.1.0, 2.1.12.2.0	2.1.122.2.6
Microsoft.AspNetCore.Server.IIS	2.2.0, 2.2.1, 2.2.2	2.2.6
Microsoft.AspNetCore.All	2.1.0 - 2.1.112.2.0 - 2.2.5	2.1.122.2.6
Microsoft.AspNetCore.App	2.1.0 - 2.1.112.2.0 - 2.2.5	2.1.122.2.6

"