Important: .NET 8.0 security update
Summary
ALSA-2024:3345: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.5-1.el8_10. Fixed in 8.0.5-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
.NET is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It is widely used for developing and running applications on various platforms. The package affected by this vulnerability is aspnetcore-runtime-8.0 in the AlmaLinux 8 ecosystem.
Vulnerability Detail
The security update addresses two vulnerabilities in .NET 8.0:
-
Stack buffer overrun in Double Parse (CVE-2024-30045): This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting a stack buffer overrun in the Double Parse function.
-
Denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046): This vulnerability could lead to a denial of service attack in ASP.NET Core applications due to a deadlock in the Http2OutputProducer.Stop() function.
These vulnerabilities can have serious consequences, including remote code execution and service disruption.
How To Fix
Minimum fixed version
8.0.5-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the affected package to the fixed version to mitigate the security vulnerabilities in .NET 8.0. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
.NET is a managed-software framework that provides a runtime environment for executing applications. It includes a set of libraries and APIs for developing various types of applications.
A stack buffer overrun occurs when a program writes data beyond the allocated memory space of a stack buffer. This can lead to memory corruption, crashes, and potentially allow an attacker to execute arbitrary code.
ASP.NET Core is an open-source web framework built on top of .NET Core. It allows developers to build cross-platform web applications using modern web development patterns.
A denial of service attack is an attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or by exploiting vulnerabilities to exhaust system resources.
To update the aspnetcore-runtime-8.0 package to the fixed version, you can use the package manager or the command-line interface of your operating system. For example, in AlmaLinux 8, you can run the command 'sudo yum update aspnetcore-runtime-8.0' to update the package.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
