Important: .NET 7.0 security update
Summary
ALSA-2023:5749: Important: .NET 7.0 security update. Affects aspnetcore-runtime-7.0 versions < 7.0.12-1.el9_2. Fixed in 7.0.12-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-7.0, is a component of .NET 7.0 that enables the execution of ASP.NET Core applications. It is widely used in web development.
Vulnerability Detail
The vulnerability identified as CVE-2023-44487 affects multiple HTTP/2 enabled web servers in the .NET 7.0 framework. It exposes these servers to a DDoS attack known as the Rapid Reset Attack. This attack can lead to service disruption and denial of service. The impact of this vulnerability can be severe, potentially affecting the availability and performance of web applications.
How To Fix
Minimum fixed version
7.0.12-1.el9_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the security update as soon as possible.
Conclusion
Updating the affected package to the recommended version is crucial to protect web servers from the Rapid Reset Attack and ensure the availability and performance of web applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-7.0 →
FAQ
The vulnerability can lead to a DDoS attack on HTTP/2 enabled web servers, causing service disruption and denial of service.
The vulnerability affects .NET 7.0 to SDK 7.0.112 and Runtime 7.0.12.
The CVSS score for this vulnerability is not mentioned in the provided information.
The acknowledgments for discovering this vulnerability are not mentioned in the provided information.
More information about this vulnerability, including the CVE page, can be found in the References section of the provided information.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-7.0.
