CVE-2022-21986: .NET Denial of Service Vulnerability in Bitnami dotnet
Summary
CVE-2022-21986: .NET Denial of Service Vulnerability. Affects dotnet across 2 version ranges.
>= 5.0.0, < 5.0.14
>= 6.0.0, < 6.0.2
Fixed in 5.0.14 or 6.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- dotnet-sdk · Bitnami
- Microsoft.AspNetCore.App.Runtime.win-x64 · NuGet
The same CVE-2022-21986 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami dotnet is an open-source framework that allows developers to build cross-platform applications using the .NET framework. It provides a runtime environment, libraries, and tools for developing and running applications. The vulnerability identified as CVE-2022-21986 poses a significant risk to the stability and availability of applications built on the Bitnami dotnet framework.
Vulnerability Detail
The CVE-2022-21986 vulnerability in Bitnami dotnet is a Denial of Service (DoS) vulnerability. It allows an attacker to exploit a flaw in the framework, leading to a complete or partial disruption of the application's functionality. This vulnerability can be triggered by sending specially crafted requests to the affected application, causing excessive resource consumption and ultimately resulting in a DoS condition. The severity of this vulnerability is rated as High.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.0.0, < 5.0.145.0.14 -
>= 6.0.0, < 6.0.26.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions mentioned above to mitigate the risk.
Conclusion
The CVE-2022-21986 vulnerability in Bitnami dotnet is a critical Denial of Service (DoS) vulnerability that can significantly impact the availability and functionality of affected applications. It is crucial to update to the fixed versions (5.0.14 or 6.0.2) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dotnet →
FAQ
The CVE-2022-21986 vulnerability can lead to a Denial of Service (DoS) condition in applications built on the Bitnami dotnet framework. This can result in the unavailability or partial functionality of the affected application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by the CVE-2022-21986 vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
At the time of this report, there are no known exploits for the CVE-2022-21986 vulnerability. However, it is crucial to update to the fixed versions to prevent potential exploitation.
Yes, patches are available for the CVE-2022-21986 vulnerability. It is recommended to update Bitnami dotnet to version 5.0.14 or 6.0.2, depending on the currently installed version.
You can find more information about the CVE-2022-21986 vulnerability in the Bitnami dotnet framework in the vulnerability database maintained by Bitnami at https://github.com/bitnami/vulndb/tree/main/data/dotnet/BIT-dotnet-2022-21986.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for dotnet.
