Important: .NET 8.0 security update
Summary
ALSA-2024:0827: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.2-2.el8_9. Fixed in 8.0.2-2.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It is widely used for developing and running applications on various platforms. The vulnerability affects the .NET SDK 8.0.102 and .NET Runtime 8.0.2 versions.
Vulnerability Detail
The security update addresses two important vulnerabilities:
-
Denial of Service in SignalR server (CVE-2024-21386): This vulnerability could allow an attacker to cause a denial of service by sending specially crafted requests to the SignalR server.
-
Denial of Service in X509Certificate2 (CVE-2024-21404): This vulnerability could allow an attacker to cause a denial of service by manipulating X509Certificate2 objects in a way that consumes excessive resources.
These vulnerabilities could potentially lead to service disruptions and impact the availability of affected applications.
How To Fix
Minimum fixed version
8.0.2-2.el8_9
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the affected packages to the fixed versions to ensure the security of your applications. If you have any further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
These vulnerabilities could potentially lead to service disruptions and impact the availability of affected applications.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is important to apply the security update to mitigate any potential risks.
There are no mentioned workarounds for these vulnerabilities. It is recommended to update the affected packages to the fixed versions.
You can find more information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related information, on the CVE pages: CVE-2024-21386 and CVE-2024-21404.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
