Moderate: dotnet6.0 security update
Summary
ALSA-2024:4438: Moderate: dotnet6.0 security update. Affects aspnetcore-runtime-6.0 versions < 6.0.32-1.el8_10. Fixed in 6.0.32-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
.NET is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications across different programming languages. The affected package, aspnetcore-runtime-6.0, is a component of .NET that enables the hosting of ASP.NET Core applications. It is vulnerable to a security issue that could lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in aspnetcore-runtime-6.0 arises from a flaw in the parsing of X.509 Content and ObjectIdentifiers. An attacker can exploit this vulnerability to cause a DoS condition, potentially disrupting the availability of affected applications. The impact of this vulnerability is moderate. The Common Vulnerability Scoring System (CVSS) score and other related information can be found on the CVE page: CVE-2024-38095.
How To Fix
Minimum fixed version
6.0.32-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The aspnetcore-runtime-6.0 package in .NET is vulnerable to a DoS attack due to a flaw in the parsing of X.509 Content and ObjectIdentifiers. To mitigate this vulnerability, it is crucial to update the package to version 6.0.32-1.el8_10 or later.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
.NET is a managed-software framework that provides a platform for developing and running applications across different programming languages.
The vulnerability can be exploited to cause a denial of service (DoS) condition, potentially disrupting the availability of affected applications.
The CVSS score for this vulnerability can be found on the CVE page: CVE-2024-38095.
To fix this vulnerability, update the affected package to version 6.0.32-1.el8_10 or later.
No workaround has been provided for this vulnerability. It is recommended to update the package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
