Moderate: dotnet7.0 security, bug fix, and enhancement update
Summary
ALSA-2022:7826: Moderate: dotnet7.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-7.0 versions < 7.0.0-0.4.rc2.el8_7. Fixed in 7.0.0-0.4.rc2.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
.NET is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. The dotnet7.0 package is a specific version of .NET that is affected by a security vulnerability.
Vulnerability Detail
The dotnet7.0 package is vulnerable to Nuget cache poisoning on Linux via a world-writable cache directory. This vulnerability, identified as CVE-2022-41032, can allow an attacker to manipulate the Nuget cache and potentially execute arbitrary code or perform unauthorized actions.
How To Fix
Minimum fixed version
7.0.0-0.4.rc2.el8_7
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The dotnet7.0 package is affected by a moderate security vulnerability that can be fixed by updating to version 7.0.100 RC 2. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
dotnet7.0 is a version of the .NET framework that includes a CLR implementation and a subset of the .NET framework APIs.
Nuget cache poisoning is a technique where an attacker manipulates the Nuget cache to inject malicious code or perform unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
Yes, updating the dotnet7.0 package to version 7.0.100 RC 2 will fix this vulnerability.
You can refer to the CVE page for CVE-2022-41032 for more details about this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
