ALSA-2023:4645 - .NET 6.0 security, bug fix, and enhancement update
Summary
ALSA-2023:4645: Important: .NET 6.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-6.0 versions < 6.0.21-1.el8_8. Fixed in 6.0.21-1.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-6.0, is a component of .NET 6.0 that enables the execution of ASP.NET Core applications. It is commonly used in web development to build high-performance and scalable web applications.
Vulnerability Detail
This vulnerability, identified as CVE-2023-35390, is a remote code execution (RCE) vulnerability that affects the dotnet command under .NET 6.0. An attacker can exploit this vulnerability to execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or further compromise of the system. Another vulnerability, CVE-2023-38180, affects the Kestrel component of .NET 6.0 and makes it susceptible to slow read attacks, which can be leveraged to launch denial of service (DoS) attacks against affected applications.
How To Fix
Minimum fixed version
6.0.21-1.el8_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the recommended fix by updating the affected package to the latest version.
Conclusion
In conclusion, the .NET 6.0 framework is affected by two vulnerabilities: CVE-2023-35390 and CVE-2023-38180. These vulnerabilities can lead to remote code execution and denial of service attacks, respectively. To mitigate these risks, it is highly recommended to update the affected package to the latest version. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
.NET 6.0 is a managed-software framework that provides a platform for developing and running applications on various operating systems. It includes a subset of the .NET framework APIs and a CLR implementation.
CVE-2023-35390 is a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the target system. This can lead to unauthorized access, data breaches, or further compromise of the system.
CVE-2023-38180 is a vulnerability that affects the Kestrel component of .NET 6.0. It can be exploited to launch slow read attacks, leading to denial of service (DoS) attacks against affected applications.
To fix this vulnerability, update the affected package to the latest version, which includes patches and security enhancements addressing the identified vulnerabilities.
No workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by updating the affected package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
