ALSA-2023:4643 - .NET 7.0 security, bug fix, and enhancement update
Summary
ALSA-2023:4643: Important: .NET 7.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-7.0 versions < 7.0.10-1.el8_8. Fixed in 7.0.10-1.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-7.0, is a component of the .NET framework that enables the execution of ASP.NET Core applications. It is commonly used in web development to build cross-platform web applications.
Vulnerability Detail
This vulnerability, identified as CVE-2023-35390, allows remote code execution (RCE) under dotnet commands. An attacker could exploit this vulnerability to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system. Another vulnerability, CVE-2023-38180, affects the Kestrel component of the .NET framework and makes it vulnerable to slow read attacks, which can result in a denial of service (DoS) attack. An attacker could exploit this vulnerability to exhaust server resources and disrupt the availability of the affected application.
How To Fix
Minimum fixed version
7.0.10-1.el8_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
Updating the affected packages to the fixed versions is crucial to protect the system from potential remote code execution and denial of service attacks. It is recommended to apply the security updates promptly. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
The vulnerabilities can lead to remote code execution and denial of service attacks, potentially resulting in unauthorized access, data breaches, and disruption of the affected application.
There are no known exploits for these vulnerabilities at the moment. However, it is important to apply the security updates as soon as possible to mitigate the risk.
Yes, these vulnerabilities can be exploited remotely. An attacker can exploit the RCE vulnerability to execute arbitrary code on the affected system, and the slow read attack vulnerability can be used to launch a DoS attack.
There is no evidence of active exploitation of these vulnerabilities at the moment. However, it is always recommended to apply security updates promptly to stay protected.
You can find more information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related information, on the CVE pages: CVE-2023-35390 and CVE-2023-38180.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
