Important: .NET 7.0 security update
Summary
ALSA-2024:0151: Important: .NET 7.0 security update. Affects aspnetcore-runtime-7.0 versions < 7.0.15-1.el9_3. Fixed in 7.0.15-1.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications across various programming languages. The affected package, aspnetcore-runtime-7.0, is a component of .NET that enables the execution of ASP.NET Core applications. It is vulnerable to multiple security issues.
Vulnerability Detail
The security update addresses several vulnerabilities in the .NET 7.0 package:
-
Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056): This vulnerability allows an attacker to gain unauthorized access to sensitive information through the MD.SqlClient and System.data.SQLClient components.
-
X509 Certificates - Validation Bypass across Azure (CVE-2024-0057): This vulnerability enables an attacker to bypass X509 certificate validation across Azure, potentially leading to unauthorized access.
-
.NET Denial of Service Vulnerability (CVE-2024-21319): This vulnerability allows an attacker to cause a denial of service by exploiting a flaw in the .NET framework.
These vulnerabilities can have severe consequences, including information disclosure, unauthorized access, and service disruption.
How To Fix
Minimum fixed version
7.0.15-1.el9_3
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the affected packages to the latest versions is crucial to mitigate the security vulnerabilities in the .NET 7.0 package. Failure to do so may result in information disclosure, unauthorized access, or denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
These vulnerabilities can lead to information disclosure, unauthorized access, and denial of service attacks. It is crucial to update the affected packages to mitigate these risks.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is essential to update the packages promptly to prevent any potential exploitation.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to update the packages to the latest versions as soon as possible.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and acknowledgments, on the respective CVE pages. The CVE IDs for the vulnerabilities are CVE-2024-0056, CVE-2024-0057, and CVE-2024-21319.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
