Moderate: .NET 6.0 security update
Summary
ALSA-2023:6245: Moderate: .NET 6.0 security update. Affects aspnetcore-runtime-6.0 versions < 6.0.24-1.el8_8. Fixed in 6.0.24-1.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications across different platforms and devices. The affected package, aspnetcore-runtime-6.0, is a component of .NET 6.0 that is used for hosting ASP.NET Core applications. It is vulnerable to a security issue that can lead to a denial of service when using .NET Kestrel with client certificates.
Vulnerability Detail
The vulnerability, identified as CVE-2023-36799, allows an attacker to perform a denial of service attack by exploiting a flaw in the handling of client certificates in .NET Kestrel. By sending specially crafted client certificates, an attacker can cause the Kestrel server to consume excessive resources, leading to a denial of service condition. This vulnerability has a moderate severity rating.
How To Fix
Minimum fixed version
6.0.24-1.el8_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest versions of the affected packages.
Conclusion
In conclusion, the .NET 6.0 security update addresses a moderate severity vulnerability in the aspnetcore-runtime-6.0 package. It is recommended to update to the latest versions of the affected packages to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
.NET is a managed-software framework that provides a platform for developing and running applications across different platforms and devices.
ASP.NET Core is a cross-platform, high-performance framework for building modern, cloud-based, internet-connected applications.
.NET Kestrel is a lightweight, cross-platform web server for ASP.NET Core applications.
A denial of service attack is an attempt to make a computer or network resource unavailable to its intended users by overwhelming the target system with excessive requests or consuming its resources.
This vulnerability has a moderate severity rating.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
