ALSA-2023:4644 - .NET 6.0 security, bug fix, and enhancement update
Summary
ALSA-2023:4644: Important: .NET 6.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-6.0 versions < 6.0.21-1.el9_2. Fixed in 6.0.21-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The AlmaLinux distribution includes several packages related to .NET, such as aspnetcore-runtime, dotnet-runtime, dotnet-sdk, and more.
Vulnerability Detail
This vulnerability affects the .NET 6.0 framework and is categorized as important. It includes two security fixes:
-
RCE under dotnet commands (CVE-2023-35390): This vulnerability allows remote code execution under certain dotnet commands, potentially leading to unauthorized access or control of the affected system.
-
Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180): This vulnerability affects the Kestrel web server and can be exploited to launch slow read attacks, causing a Denial of Service (DoS) condition, rendering the server unresponsive to legitimate requests.
How To Fix
Minimum fixed version
6.0.21-1.el9_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this vulnerability affects the .NET 6.0 framework and includes two security fixes. It is important to update the affected packages to the latest versions to mitigate the risk of remote code execution and Denial of Service attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
The .NET framework is a managed-software framework that provides a platform for developing and running applications on various operating systems.
Remote Code Execution (RCE) refers to the ability of an attacker to execute arbitrary code on a target system remotely, without having physical access to the system.
Kestrel is a cross-platform web server that is included with the .NET framework. It is often used as the default web server for ASP.NET Core applications.
A slow read attack is a type of Denial of Service (DoS) attack where an attacker sends a large number of slow or incomplete requests to a server, causing it to allocate resources and eventually become unresponsive to legitimate requests.
You can update the affected packages by using the package manager or by downloading the latest versions from the official AlmaLinux repositories.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
