Critical Vulnerability in .Net Packages: USN-6438-2
Summary
USN-6438-2: .Net regressions. Affects dotnet6 versions < 6.0.124-0ubuntu1~23.10.1. Fixed in 6.0.124-0ubuntu1~23.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .Net framework is a software development platform developed by Microsoft, enabling developers to build and run applications on Windows. It includes a large class library and supports various programming languages. The affected packages, dotnet6 and dotnet7, are essential for building and running .Net applications. They provide runtime environments and SDKs that developers rely on for application development. The recent vulnerabilities discovered pose significant risks to applications utilizing these packages.
Vulnerability Detail
The vulnerability stems from an incomplete fix for CVE-2023-36799, which relates to improper processing of X.509 certificates in .NET. This flaw could allow attackers to exploit the system, potentially leading to denial of service. Additionally, CVE-2023-44487 highlights issues in the Kestrel web server's handling of HTTP/2 requests, further increasing the risk of denial of service attacks. Both vulnerabilities can severely impact application availability and security.
How To Fix
Minimum fixed version
6.0.124-0ubuntu1~23.10.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dotnet6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling HTTP/2 support in the Kestrel web server configuration until the packages can be updated. This can be done by modifying the Kestrel server settings in your application code.
Conclusion
The vulnerabilities identified in the .Net packages dotnet6 and dotnet7 pose significant risks to applications built on this framework. It is crucial to apply the necessary updates to mitigate these risks and ensure the security and availability of your applications.
See every vulnerability recorded for dotnet6 →
FAQ
CVE-2023-36799 is a vulnerability in .NET that involves improper processing of X.509 certificates, which can lead to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of these vulnerabilities can lead to denial of service, affecting application availability and potentially exposing sensitive data.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing workarounds such as disabling HTTP/2 support in your application.
Related vulnerabilities
Recent vulnerabilities recorded for dotnet6.
