Moderate: .NET 6.0 security update
Summary
ALSA-2023:5143: Moderate: .NET 6.0 security update. Affects aspnetcore-runtime-6.0 versions < 6.0.22-1.el9_2. Fixed in 6.0.22-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-6.0, is a component of .NET 6.0 that enables the execution of ASP.NET Core applications. It is vulnerable to a security issue that can lead to a denial of service when using .NET Kestrel with client certificates.
Vulnerability Detail
The vulnerability, identified as CVE-2023-36799, allows an attacker to cause a denial of service by exploiting a flaw in the .NET Kestrel component when handling client certificates. By sending specially crafted requests, an attacker can trigger the vulnerability and disrupt the normal operation of the affected application. The impact of this vulnerability can range from temporary service disruption to a complete system crash. The severity of the vulnerability is rated as moderate.
How To Fix
Minimum fixed version
6.0.22-1.el9_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the security update provided by the package maintainers.
Conclusion
In conclusion, the .NET 6.0 package, specifically the aspnetcore-runtime-6.0 component, is vulnerable to a moderate security issue that can lead to a denial of service. To mitigate this vulnerability, it is crucial to update the affected package to the latest version provided by the package maintainers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-6.0 →
FAQ
The .NET framework is a managed-software framework that provides a platform for developing and running applications on various operating systems.
The vulnerability can lead to a denial of service, causing temporary service disruption or system crashes.
To fix this vulnerability, update the affected package to the latest version provided by the package maintainers.
No specific workarounds are mentioned. It is recommended to apply the security update.
More information about this vulnerability can be found in the CVE page listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-6.0.
