Important: .NET 8.0 security update
Summary
ALSA-2024:2842: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.5-1.el9_4. Fixed in 8.0.5-1.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that implements a subset of the .NET framework APIs and includes a CLR implementation. It provides a platform for developing and running applications on various operating systems. The affected package, aspnetcore-runtime-8.0, is a runtime component of .NET 8.0 used for running ASP.NET Core applications.
Vulnerability Detail
The security update addresses two vulnerabilities in .NET 8.0:
-
Stack buffer overrun in Double Parse (CVE-2024-30045): This vulnerability could allow an attacker to execute arbitrary code by exploiting a stack buffer overrun in the Double Parse function.
-
Denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046): This vulnerability could lead to a denial of service attack by causing a deadlock in the Http2OutputProducer.Stop() function of ASP.NET Core.
These vulnerabilities can have severe consequences, including remote code execution and service disruption.
How To Fix
Minimum fixed version
8.0.5-1.el9_4
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to mitigate the risks.
Conclusion
To ensure the security of your .NET 8.0 applications, it is crucial to update the affected package to the fixed version. Upgrade to .NET SDK 8.0.105 and .NET Runtime 8.0.5. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
These vulnerabilities can allow an attacker to execute arbitrary code and cause denial of service attacks, potentially leading to remote code execution and service disruption.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
There are no known exploits for these vulnerabilities at the time of this advisory. However, it is crucial to apply the security update to prevent potential exploitation.
Yes, you can apply the security update without upgrading to a new major version of .NET. The recommended update includes the necessary security patches for the vulnerabilities.
You can find more information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related details, on the CVE pages: CVE-2024-30045 and CVE-2024-30046.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
