Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
How could an attacker exploit this vulnerability? An attacker could provide a specially crafted application that references an unsigned NuGet package. If a user restores or runs the application on an affected Linux system, signature verification might not be enforced, allowing untrusted package content to be installed or executed. What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass required NuGet package signature verification on affected Linux systems. This could allow an unsigned package to be accepted when signature validation is required by policy.
<a href="https://www.linkedin.com/in/abdul-rehman---/">Muhammad Abdul Rehman</a>