ALSA-2023:4642 - .NET 7.0 security, bug fix, and enhancement update
Summary
ALSA-2023:4642: Important: .NET 7.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-7.0 versions < 7.0.10-1.el9_2. Fixed in 7.0.10-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-7.0, is a component of the .NET framework that enables the execution of ASP.NET Core applications. It is commonly used in web development to build high-performance and scalable web applications.
Vulnerability Detail
This vulnerability, identified as CVE-2023-35390, allows for remote code execution (RCE) under dotnet commands. An attacker could exploit this vulnerability to execute arbitrary code on a target system, potentially leading to unauthorized access, data breaches, or further compromise of the system. Another vulnerability, CVE-2023-38180, affects the Kestrel component of ASP.NET Core, making it susceptible to slow read attacks that can result in a denial of service (DoS) attack. This vulnerability could be exploited to exhaust system resources, causing the application to become unresponsive or crash.
How To Fix
Minimum fixed version
7.0.10-1.el9_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the recommended updates to mitigate the risk of exploitation.
Conclusion
To ensure the security and stability of your .NET 7.0 applications, it is highly recommended to update the affected packages to the latest fixed versions. By doing so, you can mitigate the risk of remote code execution and denial of service attacks. If you require further assistance or have any questions, please reach out to DevNack.com for support on vulnerability remediation.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
The RCE vulnerability (CVE-2023-35390) can allow an attacker to execute arbitrary code on a system, potentially leading to unauthorized access or data breaches. The DoS vulnerability (CVE-2023-38180) can result in the unresponsiveness or crashing of the affected application.
Yes, all versions of .NET 7.0 are affected by these vulnerabilities. It is recommended to update to the latest fixed versions.
Yes, both vulnerabilities can be exploited remotely. An attacker can target the affected system over a network connection to exploit the RCE vulnerability or launch slow read attacks to exploit the DoS vulnerability.
There is no evidence of active exploitation of these vulnerabilities at the time of this advisory. However, it is crucial to apply the recommended updates to mitigate the risk.
You can find more information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related details, on the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
