Moderate: .NET 6.0 security and bugfix update
Summary
ALSA-2022:6521: Moderate: .NET 6.0 security and bugfix update. Affects aspnetcore-runtime-6.0 versions < 6.0.9-1.el9_0. Fixed in 6.0.9-1.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-6.0, is a part of the .NET 6.0 framework and is used for hosting ASP.NET Core applications. It is vulnerable to a stack overflow issue via ModelStateDictionary recursion.
Vulnerability Detail
The vulnerability (CVE-2022-38013) in the aspnetcore-runtime-6.0 package allows an attacker to trigger a denial-of-service (DoS) attack by exploiting a stack overflow vulnerability in the ModelStateDictionary. By recursively adding model state entries, an attacker can cause the application to consume excessive stack memory, leading to a crash or unresponsiveness. This vulnerability can be exploited remotely without authentication, potentially impacting the availability of affected applications.
How To Fix
Minimum fixed version
6.0.9-1.el9_0
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by updating the affected package to the recommended version.
Conclusion
In conclusion, the aspnetcore-runtime-6.0 package in the .NET 6.0 framework is vulnerable to a stack overflow issue that can be exploited for a denial-of-service attack. To mitigate this vulnerability, it is crucial to update the affected package to version 6.0.9-1.el9_0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
The vulnerability allows an attacker to trigger a denial-of-service attack, potentially causing the affected application to crash or become unresponsive.
Yes, this vulnerability can be exploited remotely without authentication.
No, there is no known workaround for this vulnerability. Updating the affected package is necessary.
The affected package can be updated by using the package manager or by manually downloading and installing the updated package.
Yes, it is recommended to rebuild and redeploy the application after updating the package to ensure the fix is applied.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
