Important: .NET 7.0 security update
Summary
ALSA-2024:3340: Important: .NET 7.0 security update. Affects aspnetcore-runtime-7.0 versions < 7.0.19-1.el8_10. Fixed in 7.0.19-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-7.0, is a component of .NET that is used for running ASP.NET Core applications. It is vulnerable to a security issue that has been addressed in the latest update.
Vulnerability Detail
The vulnerability in the aspnetcore-runtime-7.0 package is related to a stack buffer overrun in Double Parse (CVE-2024-30045) and a denial of service issue in ASP.NET Core due to a deadlock in Http2OutputProducer.Stop() (CVE-2024-30046). The stack buffer overrun vulnerability could allow an attacker to execute arbitrary code or cause a crash, while the denial of service issue could lead to a service disruption. These vulnerabilities have been fixed in the latest versions of .NET SDK 7.0.119 and .NET Runtime 7.0.19.
How To Fix
Minimum fixed version
7.0.19-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the aspnetcore-runtime-7.0 package to the latest version to address the security vulnerabilities. Failure to do so could expose your system to potential attacks or service disruptions. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
The stack buffer overrun vulnerability could allow an attacker to execute arbitrary code or cause a crash, potentially leading to a compromise of the system. The denial of service issue could result in a service disruption, affecting the availability of ASP.NET Core applications.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is important to apply the security update as soon as possible to mitigate the risk.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the affected package to the latest version.
Yes, you can manually update the aspnetcore-runtime-7.0 package by downloading the latest version from the official repository and installing it using the appropriate package manager for your operating system.
You can find more information about these vulnerabilities, including the impact, CVSS score, and acknowledgments, on the CVE pages: CVE-2024-30045 and CVE-2024-30046.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
