Skip to content

Commit 566078e

Browse files
committed
Fix linter error
1 parent be3b3ca commit 566078e

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

release-notes/1.0/1.0.15/1.0.15.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,9 @@ See [.NET Core Supported OS Lifecycle Policy](https://github.com/dotnet/core/blo
3030

3131
* [CVE-2019-0657: .NET Core NuGet Tampering Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0757)
3232

33-
A tampering vulnerability exists in NuGet software when executed in a Linux or Mac environment. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that an attacker can login as any other user on that machine. At that point, the attacker will be able to replace or add to files that were created by a NuGet restore operation in the current users account.
33+
A tampering vulnerability exists in NuGet software when executed in a Linux or Mac environment. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.
34+
An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that an attacker can login as any other user on that machine.
35+
At that point, the attacker will be able to replace or add to files that were created by a NuGet restore operation in the current users account.
3436

3537
The security update addresses the vulnerability by correcting how NuGet restore creates file permissions for all files extracted to the client machine.
3638

0 commit comments

Comments
 (0)