dotnet6.0 security update
Summary
ALSA-2023:7258: Moderate: dotnet6.0 security update. Affects aspnetcore-runtime-6.0 versions < 6.0.25-1.el8_9. Fixed in 6.0.25-1.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a Common Language Runtime (CLR) implementation. It provides a platform for developing and running applications on various operating systems.
The vulnerability affects the following packages in the AlmaLinux 8 ecosystem:
- aspnetcore-runtime-6.0
- aspnetcore-targeting-pack-6.0
- dotnet-apphost-pack-6.0
- dotnet-hostfxr-6.0
- dotnet-runtime-6.0
- dotnet-sdk-6.0
- dotnet-sdk-6.0-source-built-artifacts
- dotnet-targeting-pack-6.0
- dotnet-templates-6.0
Vulnerability Detail
The vulnerability includes the following security issues:
-
Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) This vulnerability allows an attacker to write or delete arbitrary files on the system. It is caused by improper validation of user-supplied input in the FormatFtpCommand function.
-
ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) This vulnerability allows an attacker to bypass security features in Blazor forms, potentially leading to unauthorized access or data manipulation.
These vulnerabilities can have various impacts, including unauthorized access, data loss, or system compromise.
How To Fix
Minimum fixed version
6.0.25-1.el8_9
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the dotnet6.0 security update addresses two moderate-level vulnerabilities in the .NET framework. It is important to update the affected packages to the latest versions to mitigate the risk of unauthorized access, data loss, or system compromise. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
These vulnerabilities can lead to unauthorized access, data loss, or system compromise.
There are no known exploits for these vulnerabilities at the moment.
Yes, these vulnerabilities can be exploited remotely.
Yes, patches are available for these vulnerabilities. It is recommended to update the affected packages to the latest versions.
There are no known workarounds for these vulnerabilities. It is recommended to update the affected packages to the latest versions.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
