Important: .NET 7.0 security update
Summary
ALSA-2024:2843: Important: .NET 7.0 security update. Affects aspnetcore-runtime-7.0 versions < 7.0.19-1.el9_4. Fixed in 7.0.19-1.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package in this vulnerability is aspnetcore-runtime-7.0 in AlmaLinux 9.
Vulnerability Detail
The vulnerability in the aspnetcore-runtime-7.0 package is related to a stack buffer overrun in Double Parse (CVE-2024-30045) and a denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046). These vulnerabilities can be exploited by attackers to execute arbitrary code or cause a denial of service, respectively. The impact of these vulnerabilities can vary depending on the specific application using the affected package.
How To Fix
Minimum fixed version
7.0.19-1.el9_4
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the aspnetcore-runtime-7.0 package in AlmaLinux 9 is affected by two security vulnerabilities. It is crucial to update the package to the fixed version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
The impact of these vulnerabilities can vary depending on the specific application using the affected package. In the case of the stack buffer overrun vulnerability, it can allow attackers to execute arbitrary code. The denial of service vulnerability can cause the affected ASP.NET Core application to become unresponsive or crash.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
The provided vulnerability details do not mention a specific CVSS score for these vulnerabilities.
The recommended mitigation is to update the aspnetcore-runtime-7.0 package to the fixed version mentioned above. Additionally, it is always good practice to follow secure coding guidelines and regularly update software dependencies to minimize the risk of vulnerabilities.
You can refer to the CVE pages listed in the References section of the vulnerability details for more information about these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
