Supported Platform	Download (LTS)	Downloads (stable)	Downloads (preview)	How to Install
Windows (x64)	.msi	.msi	.msi	Instructions
Windows (x86)	.msi	.msi	.msi	Instructions
Ubuntu 22.04	.deb	.deb	.deb	Instructions
Ubuntu 20.04	.deb	.deb	.deb	Instructions
Ubuntu 18.04	.deb	.deb	.deb	Instructions
Ubuntu 16.04	.deb	N/A	N/A	Instructions
Debian 10	.deb	.deb	.deb	Instructions
Debian 11	.deb	.deb	.deb
CentOS 7	.rpm	.rpm	.rpm	Instructions
CentOS 8	.rpm	.rpm	.rpm
Red Hat Enterprise Linux 7	.rpm	.rpm	.rpm	Instructions
openSUSE 42.3	.rpm	.rpm	.rpm	Instructions
Fedora 35	.rpm	.rpm	.rpm	Instructions
macOS 10.13+ (x64)	.pkg	.pkg	.pkg	Instructions
macOS 11+ (arm64)	.pkg	.pkg	.pkg	Instructions
Docker				Instructions

Platform	Downloads (stable)	Downloads (preview)	How to Install
Arch Linux			Instructions
Kali Linux	.deb	.deb	Instructions
Many Linux distributions	Snapcraft	Snapcraft

Platform	Downloads (stable)	Downloads (preview)	How to Install
Windows	32-bit/64-bit	32-bit/64-bit	Instructions
macOS (x64)	64-bit	64-bit	Instructions
macOS (arm64)	64-bit	64-bit	Instructions
Linux	64-bit	64-bit	Instructions
Windows (ARM)	64-bit (preview)	64-bit	Instructions
Raspbian (ARM)	32-bit/64-bit	32-bit/64-bit	Instructions

Linux	Windows	macOS
Instructions	Instructions	Instructions

Microsoft Security Advisory CVE-2019-0981: .NET Core Denial of Service Vulnerability

Executive Summary

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Microsoft is releasing this security advisory to provide information about a vulnerability in the version .NET Core which ships with PowerShell Core 6.1 and 6.2.

A denial of service vulnerability exists when .NET Core improperly handle web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core application. The vulnerability can be exploited remotely, without authentication.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET Core application.

The update addresses the vulnerability by correcting how .NET Core applications handle web requests.

Discussion

Please use PowerShell/PowerShell#9643 for discussion of this advisory.
Please use dotnet/corefx#37651 for discussion of the .NET aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.4
6.2	6.2.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0981

Revisions

V1.0 (May 21, 2019): Advisory published.

Version 1.0
Last Updated 2019-05-21

Microsoft Security Advisory CVE-2023-21538 | .NET Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial-of-service vulnerability exists in .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial-of-service attack when an attacker sends an invalid request to an exposed endpoint.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#80449 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.9

PowerShell 7.3 is unaffected because it uses .NET 7.0.

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Johan Gorter with AFAS Software

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-21538

Revisions

V1.0 (Jan 24, 2023): Advisory published.

Version 1.0
Last Updated 2023-01-24

Microsoft Security Advisory CVE-2023-33128: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET source generator for P/Invokes that can lead to generated code freeing uninitialized memory and crashing.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/sdk#33211 for discussion of the .NET SDK aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	Not affected
7.3	7.3.5

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	Yes
Linux	Yes

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-33128

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET during crash and stack trace scenarios that could lead to loading arbitrary binaries.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/sdk#33214 for discussion of the .NET SDK aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.12
7.3	Not affected

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	No
Linux	No

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-33126

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2023-36799: .NET Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.2 and PowerShell 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET where reading a maliciously crafted X.509 certificate may result in Denial of Service. This issue only affects Linux systems.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#91950 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.14
7.3	7.3.7

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	No
macOS	No
Linux	Yes

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-36799

Revisions

V1.0 (September 19, 2023): Advisory published.

Version 1.0
Last Updated 2023-09-19

Microsoft Security Advisory CVE-2023-24895: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in how WPF applications load and render XPS documents which may result in remote code execution.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/wpf#7922 for discussion of the .NET WPF aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.12
7.3	7.3.5

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	No
Linux	No

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-24895

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2021-26423: .NET Core Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.0 and 7.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame.

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#57175 for discussion of the .NET Runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
7.0	7.0.7
7.1	7.1.4

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2021-26423

Revisions

V1.0 (August 12, 2021): Advisory published.

Version 1.0
Last Updated 2021-08-12

Microsoft Security Advisory CVE-2022-41076: PowerShell Remote Code Execution Vulnerability

Executive Summary

A remote code execution vulnerability exists in PowerShell that could lead to unauthorized command access.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.8
7.3	7.3.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2022-41076

Revisions

V1.0 (December 13, 2022): Advisory published.

Version 1.0
Last Updated 2022-12-13

Microsoft Security Advisory - Multiple UMCI bypass vulnerabilities

Executive Summary

Multiple security feature bypass vulnerability exists in PowerShell Core which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine.

To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program.

The update addresses the vulnerability by correcting how PowerShell Core validates User Mode Code Integrity policies.

System administrators are advised to update PowerShell Core to an unaffected version version (see affected software.)

Discussion

Please use PowerShell/PowerShell#8916 for discussion of this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.3
6.2	TBD, See #8915

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0627
CVE-2019-0631
CVE-2019-0632

Revisions

V1.0 (Feb 19, 2019): Advisory published.

Version 1.0
Last Updated 2019-02-19

Microsoft Security Advisory CVE-2021-41355 | .NET Core Information Disclosure Vulnerability

Executive Summary

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on non-Windows Operating systems.

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#60301 for discussion of the .NET Runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	Not affected
7.1	7.1.5

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2021-41355

Revisions

V1.0 (October 14, 2021): Advisory published.

Version 1.0
Last Updated 2021-10-14

Microsoft Security Advisory CVE-2023-28260: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET running on Windows where a runtime DLL can be loaded from an unexpected location, resulting in remote code execution

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#84637 for discussion of the .NET Runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.11
7.3	7.3.4

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

ycdxsb with VARAS@IIE

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-28260

Revisions

V1.0 (April 13, 2023): Advisory published.
V1.1 (April 13, 2023): Update language about .NET in Summary.

Version 1.1
Last Updated 2023-04-13

Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET applications where the diagnostic server can be exploited to achieve cross-session/cross-user elevation of privilege (EoP) and code execution.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#88674 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.13
7.3	7.3.6

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	No
Linux	No

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-33127

Revisions

V1.0 (July 13, 2023): Advisory published.

Version 1.0
Last Updated 2023-07-13

Microsoft Security Advisory CVE-2018-0764: Denial of Service when parsing XML documents

Microsoft Security Advisory CVE-2018-0764

Denial of Service when parsing XML documents

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the open source versions of PowerShell Core. This advisory also provides guidance on what developers can do to update their scripts and module correctly.

Microsoft is aware of a Denial of Service vulnerability in the open source versions of PowerShell Core when improper processing of XML documents by .NET Core occurs. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to an application using PowerShell to process requests.

The update addresses the vulnerability by correcting how .NET core handles XML document processing.

System administrators are advised to update PowerShell Core to version 6.0.1. This version will also address CVE-2018-0786.

Discussion

Please use PowerShell/PowerShell#6030 for discussion of this advisory.
Please use dotnet/corefx#26237 for discussion of the .NET CoreFx aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to version 6.0.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v (if, you cannot launch PowerShell Core using pwsh you are affected). If the reported version starts with 6.0.0, you are affected.
You are using PowerShell to parse XML.

How do I update to an unaffected version?

Follow the instructions at Get PowerShell to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core, please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization. This is located at https://github.com/PowerShell/. The Announcements repo (https://github.com/PowerShell/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core. This should be treated as a temporary measure. Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

External Links

CVE-2018-0764

Revisions

V1.0 (Jan 25, 2018): Advisory published.

Version 1.0
Last Updated 2018-01-25

Microsoft Security Advisory CVE-2018-8416: .NET Core Tampering Vulnerability

Executive Summary

Microsoft is aware of a tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories.

To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system.

The update addresses the vulnerability by correcting how .NET Core handles these files.

System administrators are advised to update PowerShell Core to an unaffected version version (see affected software.)

Discussion

Please use PowerShell/PowerShell#8655 for discussion of this advisory.
Please use dotnet/corefx#34427 for discussion of the .NET aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.2
6.2	TBD

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2018-8416

Revisions

V1.0 (Jan 15, 2019): Advisory published.
V1.1 (Jan 15, 2019): Fix link to CVE.

Version 1.1
Last Updated 2019-01-15

Microsoft Security Advisory CVE-2018-8415: Microsoft PowerShell Tampering Vulnerability

Executive Summary

A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code.

To exploit this vulnerability, an attacker would need to log on to the affected system and run a specially crafted application.

The security update addresses the vulnerability by correcting log management of special characters.System administrators are advised to update PowerShell Core to version 6.0.5 or 6.1.1.

Discussion

Please use PowerShell/PowerShell#8254 for discussion of this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.0	6.0.5
6.1	6.1.1
6.2	PowerShell/PowerShell#8253

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Commit IDs

f8f3774d

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Amirreza Niakanlahiji (@DissectMalware) of University of North Carolina at Charlotte

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2018-8415

Revisions

V1.0 (November 13, 2018): Advisory published.
v1.1 (November 13, 2018): Updated Acknowledgments

Version 1.1
Last Updated 2018-11-13

Microsoft Security Advisory CVE-2019-0545: .NET Core Information Disclosure Vulnerability

Executive Summary

Microsoft is aware of an information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations. An attacker who successfully exploited the vulnerability could retrieve content, that is normally restricted, from a web application.

The security update addresses the vulnerability by enforcing CORS configuration to prevent its bypass.

System administrators are advised to update PowerShell Core to an unaffected version (See Affected Software).

Discussion

Please use PowerShell/PowerShell#8654 for discussion of this advisory.
Please use dotnet/corefx#34428 for discussion of the .NET aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.2
6.2	TBD

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0545

Revisions

V1.0 (Jan 15, 2019): Advisory published.

Version 1.0
Last Updated 2018-01-15

Microsoft Security Advisory CVE-2023-32032: .NET Elevation of Privilege Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET using extracting the contents of a Tar file which may result in elevation of privileges.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#87496 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	Not affected
7.3	7.3.5

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	Yes
Linux	Yes

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-32032

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2019-0733 - Windows Defender Application Control Security Feature Bypass Vulnerability

Executive Summary

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could circumvent Windows PowerShell Constrained Language Mode on the machine.

To exploit the vulnerability, an attacker would first have access to the local machine where PowerShell is running in Constrained Language mode. By doing that an attacker could leverage script debugging to abuse signed modules in an unintended way.

The update addresses the vulnerability by correcting how PowerShell functions in Constrained Language Mode.

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Discussion

Please use PowerShell/PowerShell#9644 for discussion of this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.4
6.2	6.2.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Matt Graeber of SpecterOps

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0733

Revisions

V1.0 (May 21, 2019): Advisory published.

Version 1.0
Last Updated 2019-05-21

Microsoft Security Advisory CVE-2023-29331: .NET Denial of Service vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET when processing X.509 certificates that may result in Denial of Service.

Details: KB5025823

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#87498 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.12
7.3	7.3.5

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	Yes
Linux	Yes

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-29331

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2019-0657: PowerShell Core Domain Spoofing Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell Core 6.1 and 6.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a domain spoofing vulnerability in PowerShell Core which causes the meaning of a URI to change when International Domain Name encoding is applied. An attacker who successfully exploited the vulnerability could redirect a URI.

The security update addresses the vulnerability by disallowing certain Unicode characters from the URI.

System administrators are advised to update PowerShell Core to an unaffected version version (see affected software.)

Discussion

Please use PowerShell/PowerShell#8917 for discussion of this advisory.
Please use dotnet/corefx#35265 for discussion of the .NET Core aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.3
6.2	TBD, See #8914

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0657

Revisions

V1.0 (Feb 19, 2019): Advisory published.

Version 1.0
Last Updated 2019-02-19

Microsoft Security Advisory CVE-2022-26788: PowerShell Elevation of Privilege Vulnerability

Executive Summary

An elevation of privilege vulnerability exists in PowerShell in how it loads modules when .NET does not return a path for certain profile folders. The fix resolves the issue by not including the folders when .NET does not return a path.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	7.0.10
7.1	7.1.7
7.2	7.2.3

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Firooz Akbari of VMware
Mattias Borg with Onevinn AB
Zubair Ashraf with Crowdstrike

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2022-26788

Revisions

V1.1 (April 27, 2022): Fixed typo.
V1.0 (April 27, 2022): Advisory published.

Version 1.1
Last Updated 2022-04-27

Microsoft Security Advisory CVE-2022-23267 | .NET Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 6.0, .NET 5.0 and .NET core 3.1 where a malicious client can cause a Denial of Service via excess memory allocations through HttpClient.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#69149 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	7.0.11
7.2	7.2.4

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2022-23267

Revisions

V1.0 (May 17, 2022): Advisory published.

Version 1.0
Last Updated 2022-05-17

Microsoft Security Advisory CVE-2018-8356: .NET Framework Security Feature Bypass Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the open source versions of PowerShell Core.
This advisory also provides guidance on what developers can do to update their scripts and module correctly.

Microsoft is aware of a security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates.

An attacker could present expired certificates when challenged.

The security update addresses the vulnerability by ensuring that .NET Framework components correctly validate certificates.

System administrators are advised to update PowerShell Core to version 6.0.3 or 6.1.0-preview.4

Discussion

Please use PowerShell/PowerShell#7315 for discussion of this advisory.
Please use dotnet/wcf#3009 for discussion of the .NET WCF aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to version 6.0.3 for 6.0 or prior to 6.1.0-preview.4 for 6.1.

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v (if, you cannot launch PowerShell Core using pwsh you are affected).
If the reported version starts with 6.0.2 or earlier for 6.0 or 6.1.0-preview.3 or earlier for 6.1, you are affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core on Windows, Installing PowerShell Core on Linux, Installing PowerShell Core on ARM, or Installing PowerShell Core on macOS
to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2018-8356

Revisions

V1.0 (July 19, 2018): Advisory published.

Version 1.0
Last Updated 2018-07-19

Microsoft Security Advisory CVE-2019-0820: .NET Core Denial of Service Vulnerability

Executive Summary

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 2.1.

A denial of service vulnerability exists when .NET Core improperly process RegEx strings. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET Core application.

The update addresses the vulnerability by correcting how .NET Core applications handle RegEx string processing.

Discussion

Please use PowerShell/PowerShell#9641 for discussion of this advisory.
Please use dotnet/corefx#37649 for discussion of the .NET aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.4
6.2	6.2.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0820

Revisions

V1.0 (May 21, 2019): Advisory published.

Version 1.0
Last Updated 2019-05-21

Microsoft Security Advisory CVE 2022-41089 | .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the versions of .NET used in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 6.0 which is used in PowerShell 7.2, and .NET 7.0 which is used in PowerShell 7.3, where a malicious actor could cause a user to run arbitrary code as a result of parsing maliciously crafted xps files.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/wpf#7357 for discussion of the .NET WPF aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.9
7.3	7.3.2

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Eleftherios Panos with Nettitude
Nick Landers with NetSPI

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2022-41089

Revisions

V1.0 (Jan 24, 2023): Advisory published.

Version 1.0
Last Updated 2023-01-24

Microsoft Security Advisory CVE-2020-1108: .NET Core Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a denial of service vulnerability which exists when .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core web application. The vulnerability can be exploited remotely, without authentication.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application.

The update addresses the vulnerability by correcting how the .NET Core web application handles web requests.

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#36313 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
7.0	7.0.2
6.2	6.2.6

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2020-1108

Revisions

V1.0 (May 14, 2020): Advisory published.

v1.1 (May 16, 2020): Updated install link.

v1.2 (June 11, 2020): Updated version containing fix.

Version 1.2
Last Updated 2020-06-11

Microsoft Security Advisory CVE-2023-24897: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

This security update addresses a vulnerability in the MSDIA SDK where corrupted PDBs can cause heap overflow, leading to a crash or remote code execution.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#87501 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.12
7.3	Not affected

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	No
Linux	No

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-24897

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2018-0875: Hash Collision can cause Denial of Service

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the open source versions of PowerShell Core.
This advisory also provides guidance on what developers can do to update their scripts and module correctly.

Microsoft is aware of a security vulnerability in the public versions of .NET Core where a malicious file
or web request could cause a denial of service (DoS) attack.

System administrators are advised to update PowerShell Core to version 6.0.2.
This version will also address CVE-2018-0786.

Discussion

Please use PowerShell/PowerShell#6401 for discussion of this advisory.
Please use dotnet/corefx#28010 for discussion of the .NET CoreFx aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to version 6.0.2

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v (if, you cannot launch PowerShell Core using pwsh you are affected).
If the reported version starts with 6.0.1, you are affected.

How do I update to an unaffected version?

Follow the instructions at Get PowerShell
to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Ben Adams of Illyriad Games

External Links

CVE-2018-0875

Revisions

V1.0 (Mar 15, 2018): Advisory published.

Version 1.0
Last Updated 2018-03-15

Microsoft Security Advisory CVE-2018-8292 - .NET Core Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2018-8292

.NET Core Information Disclosure Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core and PowerShell Core 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a security feature bypass vulnerability that exists when .NET Core when HTTP authentication information is inadvertently exposed in an outbound request that encounters an HTTP redirect. An attacker who successfully exploited this vulnerability could use the information to further compromise the web application. The PowerShell cmdlets Invoke-WebRequest and Invoke-RestMethod are not affected.

System administrators running PowerShell Core applications are advised to migrate to PowerShell Core 6.1.

Discussion

Please use PowerShell/PowerShell#7981 for discussion of this advisory.
Please use dotnet/corefx#32730 for discussion of the .NET CoreFx aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to version 6.1.0

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v (if, you cannot launch PowerShell Core using pwsh you are affected).
If the reported version is any version before 6.1.0, you are affected.
You are using .NET Core HTTPClient directly.

How do I update to an unaffected version?

Follow the instructions at Get PowerShell to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core, please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization. This is located at https://github.com/PowerShell/. The Announcements repo (https://github.com/PowerShell/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core. This should be treated as a temporary measure. Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

External Links

CVE-2018-8292

Revisions

V1.0 (Oct 9, 2018): Advisory published.

Version 1.0
Last Updated 2018-01-24

Microsoft Security Advisory CVE-2020-8927 | .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A vulnerability exists in .NET 5.0 and .NET Core 3.1 where a buffer overflow exists in the Brotli library versions prior to 1.0.8.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#66346 for discussion of the .NET Runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	7.0.9
7.1	7.1.6
7.2	7.2.2

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2020-8927

Revisions

V1.0 (March 16, 2022): Advisory published.

Version 1.0
Last Updated 2022-03-16

Microsoft Security Advisory CVE-2019-0980: .NET Core Denial of Service Vulnerability

Executive Summary

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Microsoft is releasing this security advisory to provide information about a vulnerability in the version .NET Core which ships with PowerShell Core 6.1 and 6.2.

A denial of service vulnerability exists when .NET Core improperly handle web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core application. The vulnerability can be exploited remotely, without authentication.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET Core application.

The update addresses the vulnerability by correcting how .NET Core applications handle web requests.

Discussion

Please use PowerShell/PowerShell#9642 for discussion of this advisory.
Please use dotnet/corefx#37650 for discussion of the .NET aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.4
6.2	6.2.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0980

Revisions

V1.0 (May 21, 2019): Advisory published.

Version 1.0
Last Updated 2019-05-21

Microsoft Security Advisory CVE-2018-8327: Critical Remote Code Execution in PowerShell Editor Services

Microsoft Security Advisory CVE-2018-8327

Critical Remote Code Execution in PowerShell Editor Services

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the open source versions of PowerShell Editor Services & the PowerShell extension for VSCode.

This advisory also provides guidance on what users can do to update their extensions and projects.

PowerShell Editor Services has a critical remote code execution vulnerability in versions prior to 1.7.0.

Users are advised to update the version of PowerShell Editor Services they use to version 1.8.0.
Users are advised to update the PowerShell extension for VSCode to version 1.8.0.

Discussion

Please use PowerShell/PowerShellEditorServices#703 for discussion of this advisory.

Please use PowerShell/vscode-powershell#1427 for discussion of the PowerShell extension for VSCode aspects this advisory.

Affected Software

The vulnerability affects:

PowerShell Editor Services prior to version 1.7.0
The PowerShell extension for VSCode prior to version 1.7.0 - which depends on PowerShell Editor Services

Advisory FAQ

How do I know if I am affected?

PowerShell Editor Services

If you use PowerShell Editor Services in your project, check the version of the release you downloaded. If your version says 1.7.0 or lower, you are affected.

If you already have it on your machine, open PowerShell and navigate to where your Microsoft.PowerShell.EditorServices.dll is and run:

Get-ChildItem Microsoft.PowerShell.EditorServices.dll | % { $_.VersionInfo.FileVersion }

If your version says 1.7.0 or lower, you are affected.

PowerShell extension for VSCode

You can verify this in one of 2 ways.

NOTE: if you have both VSCode and VSCode Insiders installed, you will need to check both.

Via Console

If you have VSCode Stable installed:

Close all instances of VSCode
Run code --list-extensions --show-versions
Look for [email protected]. If your version says 1.7.0 or lower, you are affected.

If you have VSCode Insiders installed:

Close all instances of VSCode
Run code-insiders --list-extensions --show-versions
Look for [email protected]. If your version says 1.7.0 or lower, you are affected.

Via the VSCode GUI

Click on the Extensions icon:

Find PowerShell in the list and check the version number:

If your version says 1.7.0 or lower, you are affected.

How do I update to an unaffected version?

PowerShell Editor Services

You can grab a newer release from the Releases tab in GitHub.

PowerShell extension for VSCode

VSCode auto-updates extensions unless you disable automatic updates. Open VSCode and when prompted to reload the updated extension, do so. If your version says 1.8.0 or above, you have updated successfully.

You can update this manually as well in one of 2 ways.

NOTE: if you have both VSCode and VSCode Insiders installed, you will need to update both.

Via Console

If you have VSCode Stable installed:

Close all instances of VSCode
Run code --install-extension ms-vscode.powershell
Run code --list-extensions --show-versions
Look for [email protected]. If your version says 1.8.0 or above, you have updated successfully.

If you have VSCode Insiders installed:

Close all instances of VSCode
Run code-insiders --install-extension ms-vscode.powershell
Run code --list-extensions --show-versions
Look for [email protected]. If your version says 1.8.0 or above, you have updated successfully.

Via the VSCode GUI

Click on the Extensions icon:

Find PowerShell in the list and click the update button
Then click the reload button

If your version says 1.8.0 or higher, you have updated successfully.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Editor Services,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my extension?

File an issue and we will address it in the next release.

Acknowledgments

Ryan Cumbee (Casaba Security, LLC) & Cory Carson (Casaba Security, LLC) under contract for Microsoft at the time.

External Links

CVE-2018-8327

Revisions

V1.0 (Jul 10, 2018): Advisory published.
V1.1 (Jul 19, 2018): Added CVE link.

Version 1.1
Last Updated 2018-07-19

Microsoft Security Advisory CVE-2019-1167: Windows Defender Application Control Security Feature Bypass Vulnerability

We are using GitHub’s Security Advisory feature, the actual advisory is here:
GHSA-5frh-8cmj-gc59

Microsoft Security Advisory CVE-2021-1721: PowerShell Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.1 and 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial-of-service vulnerability exists when creating HTTPS web request during X509 certificate chain building.

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#48067 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
7.0	7.0.5
7.1	7.1.2

Advisory FAQ

How do I know if I am affected?

If the following is true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2021-1721

Revisions

V1.0 (Feb 11, 2021): Advisory published.
v1.1 (March 11, 2021): Updated link for installing PowerShell to an aka.ms link.

Version 1.1
Last Updated 2021-03-11

Microsoft Security Advisory CVE-2021-26701: .NET Core Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, and .NET Core 3.1 which were released with PowerShell 7.0 and 7.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#49377 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
7.0	7.0.6
7.1	7.1.3

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2021-26701

Revisions

V1.0 (March 11, 2021): Advisory published.
v1.1 (March 11, 2021): Updated link for installing PowerShell.
v1.2 (March 11, 2021): Updated link for installing PowerShell to an aka.ms link.

Version 1.2
Last Updated 2021-03-11

Microsoft Security Advisory CVE-2018-0786: Security Feature Bypass in X509 Certificate Validation

Microsoft Security Advisory CVE-2018-0786

Security Feature Bypass in X509 Certificate Validation

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the open source versions of PowerShell Core 6.0. This advisory also provides guidance on what developers can do to update their scripts and module correctly.

Microsoft is aware of a security vulnerability in the open source versions of PowerShell Core where an attacker could present a certificate that is marked invalid for a specific use, but a .NET Core component uses it for that purpose. This action disregards the Enhanced Key Usage tagging.

The security update addresses the vulnerability by ensuring that .NET Core components completely validate certificates.

System administrators are advised to update their PowerShell Core to version 6.0.1. This version will also address CVE-2018-0764.

Discussion

Please use PowerShell/PowerShell#6031 for discussion of this advisory.
Please use dotnet/corefx#26236 for discussion of the .NET CoreFx aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to version 6.0.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v (if, you cannot launch PowerShell Core using pwsh you are affected). If the reported version starts with 6.0.0, you are affected.
You also use one of the .NET assemblies referenced in dotnet/announcements#51

How do I update to an unaffected version?

Follow the instructions at Get PowerShell to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core, please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization. This is located at https://github.com/PowerShell/. The Announcements repo (https://github.com/PowerShell/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core. This should be treated as a temporary measure. Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

External Links

CVE-2018-0786

Revisions

V1.0 (Jan 25, 2018): Advisory published.

Version 1.0
Last Updated 2018-01-25

Microsoft Security Advisory CVE-2022-34716: .NET Information Disclosure Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell v7.0 and v7.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An information disclosure vulnerability exists in PowerShell v7.0 and v7.2 that could lead to unauthorized access of privileged information.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/announcements#232 for discussion of the .NET aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	7.0.12
7.2	7.2.6

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2022-34716

Revisions

V1.0 (August 11, 2022): Advisory published.

Version 1.0
Last Updated 2022-08-11

Microsoft Security Advisory CVE-2023-36799: .NET Denial of Service Vulnerability

Note

This is a duplicate of #49 that we re-issued.

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET where reading a maliciously crafted X.509 certificate may result in Denial of Service. This issue only affects Linux systems.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#91950 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.14
7.3	7.3.7

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	No
macOS	No
Linux	Yes

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-36799

Revisions

V1.0 (October 25, 2023): Advisory published.
V1.1 (October 26, 2023): Corrected advisory publish date.
v1.2 (October 26, 2023): Updated affected version and noted that this is a duplicate announcement.

Version 1.2
Last Updated 2023-10-26

Microsoft Security Advisory CVE-2020-0951: Windows Defender Application Control Security Feature Bypass Vulnerability

Executive Summary

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC.

To exploit the vulnerability, an attacker need administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code.

The update addresses the vulnerability by correcting how PowerShell commands are validated when WDAC protection is enabled.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	7.0.8
7.1	7.1.5

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2020-0951

Revisions

V1.0 (October 14, 2021): Advisory published.

Version 1.0
Last Updated 2021-10-14

Microsoft Security Advisory CVE-2021-34485: .NET Core Information Disclosure Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.0 and 7.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS.

System administrators are advised to update PowerShell Core to an unaffected version (see affected software.)

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#57174 for discussion of the .NET Runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
7.0	7.0.7
7.1	7.1.4

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2021-34485

Revisions

V1.0 (August 12, 2021): Advisory published.

Version 1.0
Last Updated 2021-08-12

Microsoft Security Advisory CVE-2021-43896: Spoofing issue in PowerShell 7.2

Executive Summary

This advisory addressed a potential issue in PowerShell 7.2 where specially crafted ANSI control sequences are used through the pipeline to create executable code. An attacker could potentially craft code so that it behaves differently before and after sending the code through the pipeline. The fix changes the default mode of $PSStyle.OutputRendering to Ansi and makes fixes to that mode so strings through the pipeline are not altered.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	Not Applicable
7.1	Not Applicable
7.2	7.2.1

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2021-43896

Revisions

V1.0 (December 14, 2021): Advisory published.

Version 1.0
Last Updated 2021-12-14

Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2 and 7.3. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET when deserializing a DataSet or DataTable from XML which may result in elevation of privileges.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#87500 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.12
7.3	7.3.5

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	Yes
Linux	Yes

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-24936

Revisions

V1.0 (June 28, 2023): Advisory published.

Version 1.0
Last Updated 2023-06-28

Microsoft Security Advisory CVE-2020-16886: PowerShellGet Module WDAC Bypass Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the PowerShellGet module. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a code injection vulnerability which exists in the PowerShellGet V2 module. An attacker who successfully exploited this vulnerability could bypass WDAC (Windows Defender Application Control) policy and execute arbitrary code on a policy locked-down machine.

An attacker must have administrator privileges to create a configuration that includes installing PowerShellGet V2 module onto a machine from the PowerShell Gallery. The WDAC policy must be configured to allow the module to run. After this is done, PowerShell script can be injected and run fully trusted, allowing the attacker arbitrary code execution on the machine.

System administrators are advised to update PowerShellGet to an unaffected version (see affected software.)

Discussion

Please use PowershellGetV2/620 for discussion about the PowerShellGet aspects of this advisory.

Affected Software

The vulnerability affects PowerShellGet prior to the following versions:

PowerShellGet Version	PowerShell Version	Fixed in
<= 2.2.4.1	>= 6.0	2.2.5
Any	<= 5.1	Not affected
>= 3.0.0-beta1	Any	Not affected

Advisory FAQ

How do I know if I am affected?

Run Get-Module -ListAvailable PowerShellGet | Format-List Version and find the newest version, then, check the version in the table in Affected Software to see if your version of PowerShellGet is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShellGet to install the latest version of PowerShellGet.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShellGet,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShellGet and install the previous version of PowerShellGet.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShellGet.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2020-16886

Revisions

V1.1 (December 10, 2020): Updated Affected products with details about what versions of PowerShell are affected.
V1.0 (October 13, 2020): Advisory published.

Version 1.1
Last Updated 2020-12-10

Microsoft Security Advisory: Multiple issues involving `Microsoft.DiaSymReader.Native`

Executive Summary

.NET released multiple security updates for issues involving Microsoft.DiaSymReader.Native.*.dll.
PowerShell 7 removed these binaries from the initial release of 7.3 and 7.2.12.
The current supported versions of PowerShell 7 are not affected.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

CVE list

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.12
7.3	N/A

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	No
Linux	No

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-36796
CVE-2023-36793
CVE-2023-36794
CVE-2023-36792

Revisions

V1.0 (Sep 18, 2023): Advisory published.

Version 1.0
Last Updated 2023-09-18

OpenSSL 3.0 November Security Release

PowerShell container images have beeen updated to incorporate upstream security patches for OpenSSL 3.0.

Details

An announcement from OpenSSL states that a fix for a critical severity vulnerability was released on November 1, 2022.

Affected PowerShell container images include all Ubuntu 22.04 (Jammy) images and Universal Base Image 9.x. No other PowerShell container images are affected because they use OpenSSL 1.1.

Please update to the latest image if you are unsure. On Linux, the latest and preview tags point to Ubuntu 22.04.

Microsoft Security Advisory CVE-2022-24512: PowerShell Remote Code Execution

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.2, 7.1 and 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A Remote Code Execution vulnerability exists in PowerShell 7.2, 7.1 and 7.0 where a stack buffer overrun occurs in Double Parse routine.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discussion the PowerShell aspects of this advisory.
Please use dotnet/runtime#66348 for discussion of the .NET Runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.0	7.0.9
7.1	7.1.6
7.2	7.2.2

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7.2 and newer using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2022-24512

Revisions

V1.0 (March 16, 2022): Advisory published.

Version 1.0
Last Updated 2022-03-16

Microsoft Security Advisory CVE-2019-0564: ASP.NET Core Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and 2.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application.

System administrators are advised to update PowerShell Core to an unaffected version version (see affected software.)

Discussion

Please use PowerShell/PowerShell#8657 for discussion of this advisory.
Please use dotnet/aspnetcore#6487 for discussion of the .NET aspects this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.1	6.1.2
6.2	TBD

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.
You use System.Net.WebSockets.dll.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2019-0564

Revisions

V1.0 (Jan 15, 2019): Advisory published.

Version 1.0
Last Updated 2019-01-15

Microsoft Security Advisory CVE-2023-36435: .NET Denial of Service Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in PowerShell 7.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A memory leak vulnerability exists in MsQuic.dll which may lead to Denial of Service. This issue only affects Windows systems.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime#93304 for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.3	7.3.9

The vulnerability affects PowerShell when running on the following operating systems:

Operating System	Affected
Windows	Yes
macOS	No
Linux	No

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-36435

Revisions

V1.0 (October 25, 2023): Advisory published.
V1.1 (October 26, 2023): Corrected advisory publish date.

Version 1.1
Last Updated 2023-10-26

Microsoft Security Advisory CVE-2023-21808: .NET Remote Code Execution Vulnerability

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the version of .NET used in PowerShell 7.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in how .NET reads debugging symbols, where reading a malicious symbols file may result in remote code execution.

System administrators are advised to update PowerShell 7 to an unaffected version (see affected software).

Discussion

Please open a support question to discuss the PowerShell aspects of this advisory.
Please use dotnet/runtime for discussion of the .NET runtime aspects this advisory.

Affected Software

The vulnerability affects PowerShell 7 prior to the following versions:

PowerShell 7 Version	Fixed in
7.2	7.2.10
7.3	N/A

The affected binary was not shipped in any version of 7.3 after it was out of preview.

Advisory FAQ

How do I know if I am affected?

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell 7 is affected.

How do I update to an unaffected version?

Follow the instructions at Installing PowerShell 7 to install the latest version of PowerShell 7.

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

If you have found a potential security issue in PowerShell 7,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell 7 and install the previous version of PowerShell 7.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell 7.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2023-21808

Revisions

V1.0 (Feb 24, 2023): Advisory published.

Version 1.0
Last Updated 2023-02-24

Microsoft Security Advisory CVE-2018-8256: Microsoft PowerShell Remote Code Execution Vulnerability

Executive Summary

A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could execute malicious code on a vulnerable system.

To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system.

The security update fixes the vulnerability by ensuring PowerShell properly handles files.

System administrators are advised to update PowerShell Core to version 6.0.5 or 6.1.1.

Discussion

Please use PowerShell/PowerShell#8251 for discussion of this advisory.

Affected Software

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core Version	Fixed in
6.0	6.0.5
6.1	6.1.1
6.2	PowerShell/PowerShell#8252

The vulnerability also affects Microsoft.PowerShell.Archive if it was installed from the PowerShell Gallery. The issue was fixed in version 1.2.2.

Advisory FAQ

How do I know if I am affected?

PowerShell Core

If all of the following are true:

Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for preview version of 6.0.

Microsoft.PowerShell.Archive installed from the PowerShell Gallery

Run Get-InstalledModule -name Microsoft.PowerShell.Archive from PowerShell. If the module version is less than 1.2.2.0, then you are affected.

How do I update to an unaffected version?

PowerShell Core

Follow the instructions at Installing PowerShell Core to install the latest version of PowerShell Core.

Microsoft.PowerShell.Archive installed from the PowerShell Gallery

Run Update-Module Microsoft.PowerShell.Archive

Other Information

Commit IDs

3f85c94b
da5d8e70

Reporting Security Issues

If you have found a potential security issue in PowerShell Core,
please email details to [email protected].

Support

You can ask questions about this issue on GitHub in the PowerShell organization.
This is located at https://github.com/PowerShell/.
The Announcements repo (https://github.com/PowerShell/Announcements)
will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my script or module?

You can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.
This should be treated as a temporary measure.
Therefore, the script or module should be updated to work with the patched version of PowerShell Core.

Acknowledgments

Snyk Security Research Team

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.

See acknowledgments for more information.

External Links

CVE-2018-8256

Revisions

V1.0 (November 13, 2018): Advisory published.
V1.1 (November 14, 2018): Fix typo in how to tell if `Microsoft.PowerShell.Archive' in affected when installed from the PowerShell Gallery.

Version 1.1
Last Updated 2018-11-14

powershell / announcements Goto Github PK

announcements's Introduction

PowerShell

Windows PowerShell vs. PowerShell Core

New to PowerShell?

Get PowerShell

Upgrading PowerShell

Community Dashboard

Discussions

Chat

Add-ons and libraries

Building the Repository

Build status of nightly builds

Downloading the Source Code

Developing and Contributing

Support

Legal and Licensing

Windows Docker Files and Images

Telemetry

Governance

announcements's People

Contributors

Stargazers

Watchers

Forkers

announcements's Issues

Microsoft Security Advisory CVE-2019-0981: .NET Core Denial of Service Vulnerability

Executive Summary

Discussion

Advisory FAQ

How do I know if I am affected?

How do I update to an unaffected version?

Other Information

Reporting Security Issues

Support

What if the update breaks my script or module?

Acknowledgments

External Links

Revisions

Microsoft Security Advisory CVE-2023-21538 | .NET Denial of Service Vulnerability

Executive Summary

Discussion

Advisory FAQ

How do I know if I am affected?

How do I update to an unaffected version?

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

Support

Disclaimer

What if the update breaks my script or module?

Acknowledgments

External Links

Revisions

Microsoft Security Advisory CVE-2023-33128: .NET Remote Code Execution Vulnerability

Executive Summary

Discussion

Advisory FAQ

How do I know if I am affected?

How do I update to an unaffected version?

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

Support

Disclaimer

What if the update breaks my script or module?

Acknowledgments

External Links

Revisions

Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability

Executive Summary

Discussion

Advisory FAQ

How do I know if I am affected?

How do I update to an unaffected version?

Updating PowerShell 7 using Microsoft Update

Other Information

Reporting Security Issues

Support

Disclaimer