{"uuid": "06657378-1cd8-4e41-af4d-75f4c9149c8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-38095", "type": "seen", "source": "https://gist.github.com/djlan/2bffe000abe2da256295cd312d8f1683", "content": "# PR \u89e3\u91ca: [SECURITY] Bump Microsoft.AspNet.OData from 7.7.9 to 7.8.0\n\n\u4e3a\u4fee\u590d Component Governance \u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff0c\u5c06 OData \u4f9d\u8d56\u5e93\u5347\u7ea7\u4e00\u4e2a\u5c0f\u7248\u672c\u4ee5\u5f15\u5165\u5b89\u5168\u52a0\u56fa\u4e0e\u4f20\u9012\u6027 CVE \u4fee\u590d\u3002\n\n**PR \u94fe\u63a5**: https://dev.azure.com/powerbi/MWC/_git/workload-notebook/pullrequest/1031926\n**\u4f5c\u8005**: Dependabot\n**\u72b6\u6001**: active\n**\u5206\u652f**: `dependabot/nuget/Microsoft.AspNet.OData-7.8.0-240356` \u2192 `master`\n**\u53d8\u66f4\u7edf\u8ba1**: 2 files changed\uff08\u4f9d\u8d56\u7248\u672c\u6e05\u5355\uff09\n\n## \u76ee\u5f55\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n\n---\n\n## \u53d8\u66f4\u6982\u89c8\n\n### 1. \u4f9d\u8d56\u7248\u672c\u5347\u7ea7\uff08\u5b89\u5168\u4fee\u590d\uff09\n\n**\u76ee\u7684**: \u4ed3\u5e93\u7684 Component Governance \u626b\u63cf\u68c0\u51fa\u4e86\u4e00\u6761\u9ad8\u5371\u544a\u8b66\uff08CG Alert 14255632: MVS-2026-06-04-odata-private-fix-B\uff09\u3002Dependabot \u81ea\u52a8\u521b\u5efa\u6b64 PR\uff0c\u5c06 `Microsoft.AspNet.OData` \u4ece `7.7.9` \u63d0\u5347\u81f3 `7.8.0`\uff0c\u4ee5\u6d88\u9664\u8be5\u544a\u8b66\u5e76\u540c\u6b65\u8ba1\u5165 S360 KPI \"1ES Open Source Vulnerabilities\"\u3002\u4e4b\u6240\u4ee5\u8981\u5347\u7ea7\u800c\u975e\u5ffd\u7565\uff0c\u662f\u56e0\u4e3a 7.8.0 \u7248\u672c\u5bf9 OData \u67e5\u8be2/\u8bf7\u6c42\u5904\u7406\u589e\u52a0\u4e86\u5b89\u5168\u52a0\u56fa\u80fd\u529b\uff0c\u5e76\u4fee\u590d\u4e86\u591a\u4e2a\u4f20\u9012\u6027\u4f9d\u8d56\u4e2d\u7684 CVE\u3002\n\n**\u6d89\u53ca\u6587\u4ef6**:\n- [Directory.Packages.props](https://dev.azure.com/powerbi/MWC/_git/workload-notebook/pullrequest/1031926?path=/Directory.Packages.props&_a=files) \u2014 \u96c6\u4e2d\u5f0f\u5305\u7248\u672c\u7ba1\u7406\u6587\u4ef6\uff0c\u4ec5\u5c06 `Microsoft.AspNet.OData` \u7684 `PackageVersion` \u7531 `7.7.9` \u6539\u4e3a `7.8.0`\uff0c\u4e00\u884c\u53d8\u66f4\u3002\n\n**\u5173\u952e\u53d8\u66f4**:\n1. **\u63d0\u5347 OData \u4e3b\u5e93\u7248\u672c**: \u5728\u4e2d\u592e\u5305\u7248\u672c\u6e05\u5355\u4e2d\u9501\u5b9a `Microsoft.AspNet.OData` \u4e3a `7.8.0`\u3002\u7531\u4e8e\u4ed3\u5e93\u91c7\u7528\u96c6\u4e2d\u5f0f\u5305\u7248\u672c\u7ba1\u7406\uff08Central Package Management\uff09\uff0c\u8fd9\u4e00\u5904\u4fee\u6539\u4f1a\u4f5c\u7528\u4e8e\u6240\u6709\u5f15\u7528\u8be5\u5305\u7684\u9879\u76ee\uff0c\u65e0\u9700\u9010\u9879\u76ee\u6539\u52a8\u3002\n2. **\u5f15\u5165 `MaxReceivedMessageSize` \u4e0a\u9650\uff08100 MB\uff09**: \u65e7\u7248\u672c\u9ed8\u8ba4 `Int64.MaxValue`\uff0c\u5141\u8bb8\u4efb\u610f\u5927\u5c0f\u7684\u8bf7\u6c42\u4f53\uff0c\u5b58\u5728\u65e0\u754c\u8d44\u6e90\u5206\u914d\u98ce\u9669\uff08CWE-770\uff09\u3002\u65b0\u7248\u672c\u5728 `ODataBatchHandler` \u4e0e\u6d88\u606f\u8bfb\u5199\u8bbe\u7f6e\u4e0a\u9ed8\u8ba4\u65bd\u52a0 100 MB \u4e0a\u9650\uff0c\u5e76\u5728 `ODataOptions` \u4e0a\u65b0\u589e\u53ef\u914d\u7f6e\u7684 `MaxReceivedMessageSize` \u5c5e\u6027\u3002\n3. **\u9650\u5236 `$filter` \u4e2d\u5d4c\u5957\u51fd\u6570\u8c03\u7528/`cast()` \u94fe\u6df1\u5ea6**: \u65b0\u589e\u53ef\u914d\u7f6e\u7684 `MaxFunctionCallDepth`\uff08\u9ed8\u8ba4 15\uff0c\u6700\u5c0f 1\uff09\uff0c\u5728 `FilterQueryValidator` \u4e0e `ExpressionBinderBase` \u4e2d\u5f3a\u5236\u6267\u884c\uff0c\u9632\u6b62\u56e0\u8fc7\u6df1\u8868\u8fbe\u5f0f\uff08\u5982 `length(tolower(trim(name)))`\uff09\u5bfc\u81f4\u6808\u6ea2\u51fa/DoS\u3002\n4. **\u4fee\u590d\u4f20\u9012\u6027 CVE**: \u901a\u8fc7\u5347\u7ea7 `System.Formats.Asn1`\u3001`Microsoft.AspNetCore.Server.Kestrel.Core` \u7b49\u95f4\u63a5\u4f9d\u8d56\uff0c\u89e3\u51b3 CVE-2024-38095 \u4e0e CVE-2025-55315\u3002\n\n[\u2191 \u8fd4\u56de\u76ee\u5f55](#\u76ee\u5f55)\n\n---\n\n## \u5f71\u54cd\u5206\u6790\n\n- **\u5f71\u54cd\u8303\u56f4**: \u4ec5\u89e6\u53ca\u4f9d\u8d56\u7248\u672c\u6e05\u5355\uff0c\u5c5e\u4e8e\u6784\u5efa/\u4f9d\u8d56\u5c42\u9762\u7684\u53d8\u66f4\uff1b\u8fd0\u884c\u65f6\u53d7\u5f71\u54cd\u7684\u662f\u6240\u6709\u4f7f\u7528 `Microsoft.AspNet.OData` \u5904\u7406 OData \u8bf7\u6c42\u7684\u670d\u52a1\u7aef\u70b9\u3002\n- **\u7528\u6237\u611f\u77e5**: \u6b63\u5e38\u4e1a\u52a1\u529f\u80fd\u65e0\u53ef\u89c1\u53d8\u5316\uff1b\u4f46\u7531\u4e8e\u65b0\u589e\u4e86\u9ed8\u8ba4\u7684\u8bf7\u6c42\u4f53\u5927\u5c0f\u4e0a\u9650\uff08100 MB\uff09\u4e0e\u51fd\u6570\u8c03\u7528\u6df1\u5ea6\u4e0a\u9650\uff0815\uff09\uff0c\u6b64\u524d\u4f9d\u8d56\u8d85\u5927\u8bf7\u6c42\u4f53\u6216\u8d85\u6df1 `$filter` \u8868\u8fbe\u5f0f\u7684\u8c03\u7528\u65b9\u53ef\u80fd\u4f1a\u5f00\u59cb\u6536\u5230\u62d2\u7edd\u54cd\u5e94\u3002\n- **\u98ce\u9669\u70b9**:\n  1. **\u9ed8\u8ba4\u884c\u4e3a\u6536\u7d27\uff08\u6f5c\u5728\u7834\u574f\u6027\u53d8\u66f4\uff09**: `MaxReceivedMessageSize` \u9ed8\u8ba4\u4ece\u65e0\u9650\u6536\u7a84\u5230 100 MB\u3002\u82e5\u73b0\u6709\u573a\u666f\u5b58\u5728\u5927\u4e8e 100 MB \u7684\u5408\u6cd5 OData \u6279\u5904\u7406/\u8bf7\u6c42\uff0c\u5347\u7ea7\u540e\u4f1a\u88ab\u62d2\u7edd\uff0c\u9700\u8981\u663e\u5f0f\u8c03\u9ad8\u8be5\u914d\u7f6e\u3002\n  2. **`$filter` \u8868\u8fbe\u5f0f\u6df1\u5ea6\u9650\u5236**: `MaxFunctionCallDepth` \u9ed8\u8ba4 15\u3002\u82e5\u6709\u5ba2\u6237\u7aef\u6784\u9020\u4e86\u8d85\u8fc7\u8be5\u6df1\u5ea6\u7684\u5d4c\u5957\u51fd\u6570\u8868\u8fbe\u5f0f\uff0c\u5c06\u89e6\u53d1 `MaxFunctionCallDepthExceeded` \u9519\u8bef\uff0c\u9700\u8bc4\u4f30\u65e2\u6709\u67e5\u8be2\u662f\u5426\u53d7\u5f71\u54cd\u3002\n  3. **\u4f20\u9012\u6027\u4f9d\u8d56\u8054\u52a8**: 7.8.0 \u4f1a\u62c9\u9ad8 `System.Formats.Asn1`\u3001`Kestrel.Core` \u7b49\u95f4\u63a5\u4f9d\u8d56\u7248\u672c\uff0c\u5b58\u5728\u4e0e\u4ed3\u5e93\u4e2d\u5176\u4ed6\u5305\u7248\u672c\u7ea6\u675f\u51b2\u7a81\u7684\u53ef\u80fd\uff0c\u9700\u5173\u6ce8\u8fd8\u539f\u4e0e\u6784\u5efa\u662f\u5426\u901a\u8fc7\u3002\n  4. **\u9a8c\u8bc1\u5efa\u8bae**: \u8be5 PR \u7531 Dependabot \u81ea\u52a8\u751f\u6210\uff0c\u65e0\u4ed3\u5e93\u4e0a\u4e0b\u6587\uff1b\u5408\u5e76\u524d\u5e94\u786e\u8ba4 CI \u6784\u5efa\u3001\u4f9d\u8d56\u8fd8\u539f\u4e0e OData \u76f8\u5173\u96c6\u6210\u6d4b\u8bd5\u5168\u90e8\u901a\u8fc7\uff0c\u5e76\u5728 2 \u4e2a\u5de5\u4f5c\u65e5\u5185\u8bc4\u5ba1\u5408\u5165\u4ee5\u5173\u95ed\u9ad8\u5371\u544a\u8b66\u3002\n", "creation_timestamp": "2026-07-22T14:13:42.633081Z"}