var-202209-0872
Vulnerability from variot
.NET Core and Visual Studio Denial of Service Vulnerability. 9) - aarch64, s390x, x86_64
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: .NET 6.0 on RHEL 7 security and bugfix update Advisory ID: RHSA-2022:6520-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:6520 Issue date: 2022-09-14 CVE Names: CVE-2022-38013 ==================================================================== 1. Summary:
An update for .NET 6.0 is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64
- Description:
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.109 and .NET Runtime 6.0.9.
Security Fix(es):
- dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion. (CVE-2022-38013)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2125124 - CVE-2022-38013 dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion.
- Package List:
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7):
Source: rh-dotnet60-dotnet-6.0.109-1.el7_9.src.rpm
x86_64: rh-dotnet60-aspnetcore-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-apphost-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-debuginfo-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-host-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-hostfxr-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-sdk-6.0-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-templates-6.0-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-netstandard-targeting-pack-2.1-6.0.109-1.el7_9.x86_64.rpm
.NET Core on Red Hat Enterprise Linux Server (v. 7):
Source: rh-dotnet60-dotnet-6.0.109-1.el7_9.src.rpm
x86_64: rh-dotnet60-aspnetcore-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-apphost-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-debuginfo-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-host-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-hostfxr-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-sdk-6.0-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-templates-6.0-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-netstandard-targeting-pack-2.1-6.0.109-1.el7_9.x86_64.rpm
.NET Core on Red Hat Enterprise Linux Workstation (v. 7):
Source: rh-dotnet60-dotnet-6.0.109-1.el7_9.src.rpm
x86_64: rh-dotnet60-aspnetcore-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-apphost-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-debuginfo-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-host-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-hostfxr-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-sdk-6.0-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm rh-dotnet60-dotnet-templates-6.0-6.0.109-1.el7_9.x86_64.rpm rh-dotnet60-netstandard-targeting-pack-2.1-6.0.109-1.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-38013 https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYyInv9zjgjWX9erEAQhEug/+MGAj1xrvbqq9vXQuWFCnKNGFZox0XF9f mZBPH4fdktB0JGhvSc6zEZ9HzhwGGXWOsC6unQwlAxJwG5tHQ+ocyeUmDR5DwSNy scx7DFZQj0tHCo8q+XF7noyu5fvdOzUBeQsqUUrQQb9PsuwPtNIdtTV7Rmm0YRox xzLdtGqmmj7/Jvlry7hc9dFVJ9gnQXGHP2gWsJLWNLB+Xp1hD9iAdHyY48O/9z/H Zh05iBlxLCPeQcs0XJ9UuaIs9TVyGlCnQqVh2fdbMsDokFlwf4BppyV3fFDlYILl W7Iru5k8sSgskYxfhvedYJLYVON9/CWnpHE4RmusQqGvLM1aLX6oK5oNTWfcQ1jt rb055kapyXbGF5b4LcokE+CMY3BMC7ynxxYO9TBFrn+Ko7qP67NUVRUZReRZ0Ue5 axzUnHAZz6POpgpqwK98DF/janKj4wcnHUoCbJjgIo+JxZkgjay4umt+DAFetkfF Gm9LAxGclHlwTMfJa5nmSbuYfRrddLJ8+ENvctoNTC2g7DDUUinIOimaHu6xGFQH sTBB5+7lLFeq55EHxiT0JAnT5dIgYiexwtujxZSa4tvYal3ubQQBJ31Lp7b6BtD2 +crq7IgSjQlKhxVCv6AIBVdZriB4VBz9a/7lcGe8KPaZvWt/AEA9kPDZXUOUV0gU kfEWkmIv1MQ=RwCJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-5609-1 September 13, 2022
dotnet6 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
.NET 6 could be made to crash if it parsed a specially crafted file.
Software Description: - dotnet6: dotNET CLI tools and runtime
Details:
Graham Esau discovered that .NET 6 incorrectly parsed certain payloads during model binding. An attacker could possibly use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04 LTS: aspnetcore-runtime-6.0 6.0.109-0ubuntu1~22.04.1 dotnet-host 6.0.109-0ubuntu1~22.04.1 dotnet-hostfxr-6.0 6.0.109-0ubuntu1~22.04.1 dotnet-runtime-6.0 6.0.109-0ubuntu1~22.04.1 dotnet-sdk-6.0 6.0.109-0ubuntu1~22.04.1 dotnet6 6.0.109-0ubuntu1~22.04.1
In general, a standard system update will make all the necessary changes. A restart may be required after the update if any affected files are being used
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202209-0872", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "36" }, { "model": "visual studio 2022", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "17.3" }, { "model": "visual studio 2019", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "16.11" }, { "model": ".net", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "6.0.0" }, { "model": ".net core", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "3.1" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "35" }, { "model": "visual studio 2022", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "17.0" }, { "model": "visual studio 2019", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "16.9" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "37" }, { "model": "visual studio 2022", "scope": "eq", "trust": 1.0, "vendor": "microsoft", "version": "17.2" }, { "model": ".net core", "scope": null, "trust": 0.8, "vendor": "\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8", "version": null }, { "model": "microsoft visual studio", "scope": null, "trust": 0.8, "vendor": "\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8", "version": null }, { "model": "visual studio 2022 for mac", "scope": "eq", "trust": 0.8, "vendor": "\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8", "version": "17.3" }, { "model": ".net", "scope": null, "trust": 0.8, "vendor": "\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "NVD", "id": "CVE-2022-38013" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:microsoft:.net_core:3.1:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_2019:16.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_2019:16.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_2022:17.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:.net:6.0.0:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_2022:17.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_2022:17.3:*:*:*:*:mac:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:microsoft:visual_studio_2022:17.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2022-38013" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Graham Esau with Vonage\u003c/a\u003e", "sources": [ { "db": "CNNVD", "id": "CNNVD-202209-835" } ], "trust": 0.6 }, "cve": "CVE-2022-38013", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "secure@microsoft.com", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "OTHER", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "JVNDB-2022-002370", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "secure@microsoft.com", "id": "CVE-2022-38013", "trust": 1.0, "value": "HIGH" }, { "author": "OTHER", "id": "JVNDB-2022-002370", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-202209-835", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "NVD", "id": "CVE-2022-38013" }, { "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": ".NET Core and Visual Studio Denial of Service Vulnerability. 9) - aarch64, s390x, x86_64\n\n3. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: .NET 6.0 on RHEL 7 security and bugfix update\nAdvisory ID: RHSA-2022:6520-01\nProduct: .NET Core on Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2022:6520\nIssue date: 2022-09-14\nCVE Names: CVE-2022-38013\n====================================================================\n1. Summary:\n\nAn update for .NET 6.0 is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\n.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64\n.NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64\n.NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. Description:\n\n.NET is a managed-software framework. It implements a subset of the .NET\nframework APIs and several new APIs, and it includes a CLR implementation. \n\nNew versions of .NET that address a security vulnerability are now\navailable. The updated versions are .NET SDK 6.0.109 and .NET Runtime\n6.0.9. \n\nSecurity Fix(es):\n\n* dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow\nvia ModelStateDictionary recursion. (CVE-2022-38013)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n2125124 - CVE-2022-38013 dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion. \n\n6. Package List:\n\n.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nrh-dotnet60-dotnet-6.0.109-1.el7_9.src.rpm\n\nx86_64:\nrh-dotnet60-aspnetcore-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-apphost-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-debuginfo-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-host-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-hostfxr-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-sdk-6.0-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-templates-6.0-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-netstandard-targeting-pack-2.1-6.0.109-1.el7_9.x86_64.rpm\n\n.NET Core on Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-dotnet60-dotnet-6.0.109-1.el7_9.src.rpm\n\nx86_64:\nrh-dotnet60-aspnetcore-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-apphost-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-debuginfo-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-host-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-hostfxr-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-sdk-6.0-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-templates-6.0-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-netstandard-targeting-pack-2.1-6.0.109-1.el7_9.x86_64.rpm\n\n.NET Core on Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-dotnet60-dotnet-6.0.109-1.el7_9.src.rpm\n\nx86_64:\nrh-dotnet60-aspnetcore-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-apphost-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-debuginfo-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-host-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-hostfxr-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-runtime-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-sdk-6.0-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-targeting-pack-6.0-6.0.9-1.el7_9.x86_64.rpm\nrh-dotnet60-dotnet-templates-6.0-6.0.109-1.el7_9.x86_64.rpm\nrh-dotnet60-netstandard-targeting-pack-2.1-6.0.109-1.el7_9.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2022-38013\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2022 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYyInv9zjgjWX9erEAQhEug/+MGAj1xrvbqq9vXQuWFCnKNGFZox0XF9f\nmZBPH4fdktB0JGhvSc6zEZ9HzhwGGXWOsC6unQwlAxJwG5tHQ+ocyeUmDR5DwSNy\nscx7DFZQj0tHCo8q+XF7noyu5fvdOzUBeQsqUUrQQb9PsuwPtNIdtTV7Rmm0YRox\nxzLdtGqmmj7/Jvlry7hc9dFVJ9gnQXGHP2gWsJLWNLB+Xp1hD9iAdHyY48O/9z/H\nZh05iBlxLCPeQcs0XJ9UuaIs9TVyGlCnQqVh2fdbMsDokFlwf4BppyV3fFDlYILl\nW7Iru5k8sSgskYxfhvedYJLYVON9/CWnpHE4RmusQqGvLM1aLX6oK5oNTWfcQ1jt\nrb055kapyXbGF5b4LcokE+CMY3BMC7ynxxYO9TBFrn+Ko7qP67NUVRUZReRZ0Ue5\naxzUnHAZz6POpgpqwK98DF/janKj4wcnHUoCbJjgIo+JxZkgjay4umt+DAFetkfF\nGm9LAxGclHlwTMfJa5nmSbuYfRrddLJ8+ENvctoNTC2g7DDUUinIOimaHu6xGFQH\nsTBB5+7lLFeq55EHxiT0JAnT5dIgYiexwtujxZSa4tvYal3ubQQBJ31Lp7b6BtD2\n+crq7IgSjQlKhxVCv6AIBVdZriB4VBz9a/7lcGe8KPaZvWt/AEA9kPDZXUOUV0gU\nkfEWkmIv1MQ=RwCJ\n-----END PGP SIGNATURE-----\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. ==========================================================================\nUbuntu Security Notice USN-5609-1\nSeptember 13, 2022\n\ndotnet6 vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.04 LTS\n\nSummary:\n\n.NET 6 could be made to crash if it parsed a specially crafted file. \n\nSoftware Description:\n- dotnet6: dotNET CLI tools and runtime\n\nDetails:\n\nGraham Esau discovered that .NET 6 incorrectly parsed certain payloads\nduring model binding. An attacker could possibly use this issue to\ncause a denial of service. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.04 LTS:\n aspnetcore-runtime-6.0 6.0.109-0ubuntu1~22.04.1\n dotnet-host 6.0.109-0ubuntu1~22.04.1\n dotnet-hostfxr-6.0 6.0.109-0ubuntu1~22.04.1\n dotnet-runtime-6.0 6.0.109-0ubuntu1~22.04.1\n dotnet-sdk-6.0 6.0.109-0ubuntu1~22.04.1\n dotnet6 6.0.109-0ubuntu1~22.04.1\n\nIn general, a standard system update will make all the necessary \nchanges. A restart may be required after the update if any affected \nfiles are being used", "sources": [ { "db": "NVD", "id": "CVE-2022-38013" }, { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "PACKETSTORM", "id": "168388" }, { "db": "PACKETSTORM", "id": "168385" }, { "db": "PACKETSTORM", "id": "168389" }, { "db": "PACKETSTORM", "id": "168390" }, { "db": "PACKETSTORM", "id": "168373" }, { "db": "PACKETSTORM", "id": "168396" } ], "trust": 2.16 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-38013", "trust": 3.8 }, { "db": "JVNDB", "id": "JVNDB-2022-002370", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "168390", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "168373", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "168396", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2022.4603", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2022.4596", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202209-835", "trust": 0.6 }, { "db": "PACKETSTORM", "id": "168388", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "168385", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "168389", "trust": 0.1 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "PACKETSTORM", "id": "168388" }, { "db": "PACKETSTORM", "id": "168385" }, { "db": "PACKETSTORM", "id": "168389" }, { "db": "PACKETSTORM", "id": "168390" }, { "db": "PACKETSTORM", "id": "168373" }, { "db": "PACKETSTORM", "id": "168396" }, { "db": "NVD", "id": "CVE-2022-38013" }, { "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "id": "VAR-202209-0872", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.21178882 }, "last_update_date": "2023-12-21T22:10:27.238000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": ".NET\u00a0Core\u00a0and\u00a0Visual\u00a0Studio\u00a0Denial\u00a0of\u00a0Service\u00a0Vulnerability Security Update Guide", "trust": 0.8, "url": "https://msrc.microsoft.com/update-guide/en-us/vulnerability/cve-2022-38013" }, { "title": "Microsoft .NET Core and Microsoft Visual Studio Security vulnerabilities", "trust": 0.6, "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=207344" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-noinfo", "trust": 1.0 }, { "problemtype": "Lack of information (CWE-noinfo) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "NVD", "id": "CVE-2022-38013" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.6, "url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2022-38013" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-38013" }, { "trust": 1.1, "url": "https://access.redhat.com/security/cve/cve-2022-38013" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2cul3z7meed7rfqzvgql2mtksffzkaay/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7hcv4tqgotofho5etrkgfkagyv2yauve/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ja6f4cdkli3malv6uk3p2dr5agcltt7y/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/k4k5yl7usokir3o2dukbzmypwxypdkxg/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/wl334ckoha6bqqsyjw365hiwj4ioe45m/" }, { "trust": 0.8, "url": "https://www.ipa.go.jp/security/ciadr/vul/20220914-ms.html" }, { "trust": 0.8, "url": "https://www.jpcert.or.jp/at/2022/at220024.html" }, { "trust": 0.6, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/k4k5yl7usokir3o2dukbzmypwxypdkxg/" }, { "trust": 0.6, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2cul3z7meed7rfqzvgql2mtksffzkaay/" }, { "trust": 0.6, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7hcv4tqgotofho5etrkgfkagyv2yauve/" }, { "trust": 0.6, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/wl334ckoha6bqqsyjw365hiwj4ioe45m/" }, { "trust": 0.6, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ja6f4cdkli3malv6uk3p2dr5agcltt7y/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2022.4603" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/microsoft-net-visual-studio-denial-of-service-39266" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-38013/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/168390/red-hat-security-advisory-2022-6522-01.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2022.4596" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/168373/ubuntu-security-notice-usn-5609-1.html" }, { "trust": 0.6, "url": "https://msrc.microsoft.com/update-guide/vulnerability/cve-2022-38013" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/168396/red-hat-security-advisory-2022-6539-01.html" }, { "trust": 0.5, "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.5, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.5, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.5, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.5, "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "trust": 0.5, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2022:6523" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2022:6521" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2022:6520" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2022:6522" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/dotnet6/6.0.109-0ubuntu1~22.04.1" }, { "trust": 0.1, "url": "https://ubuntu.com/security/notices/usn-5609-1" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2022:6539" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "PACKETSTORM", "id": "168388" }, { "db": "PACKETSTORM", "id": "168385" }, { "db": "PACKETSTORM", "id": "168389" }, { "db": "PACKETSTORM", "id": "168390" }, { "db": "PACKETSTORM", "id": "168373" }, { "db": "PACKETSTORM", "id": "168396" }, { "db": "NVD", "id": "CVE-2022-38013" }, { "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "db": "PACKETSTORM", "id": "168388" }, { "db": "PACKETSTORM", "id": "168385" }, { "db": "PACKETSTORM", "id": "168389" }, { "db": "PACKETSTORM", "id": "168390" }, { "db": "PACKETSTORM", "id": "168373" }, { "db": "PACKETSTORM", "id": "168396" }, { "db": "NVD", "id": "CVE-2022-38013" }, { "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-09-21T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "date": "2022-09-15T14:19:18", "db": "PACKETSTORM", "id": "168388" }, { "date": "2022-09-15T14:17:56", "db": "PACKETSTORM", "id": "168385" }, { "date": "2022-09-15T14:19:41", "db": "PACKETSTORM", "id": "168389" }, { "date": "2022-09-15T14:19:51", "db": "PACKETSTORM", "id": "168390" }, { "date": "2022-09-14T15:07:11", "db": "PACKETSTORM", "id": "168373" }, { "date": "2022-09-15T14:21:28", "db": "PACKETSTORM", "id": "168396" }, { "date": "2022-09-13T19:15:12.867000", "db": "NVD", "id": "CVE-2022-38013" }, { "date": "2022-09-13T00:00:00", "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-09-21T09:04:00", "db": "JVNDB", "id": "JVNDB-2022-002370" }, { "date": "2023-12-20T20:15:14.580000", "db": "NVD", "id": "CVE-2022-38013" }, { "date": "2022-12-09T00:00:00", "db": "CNNVD", "id": "CNNVD-202209-835" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202209-835" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": ".NET\u00a0Core\u00a0 and \u00a0Visual\u00a0Studio\u00a0 Service operation interruption in \u00a0(DoS)\u00a0 Vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-002370" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "other", "sources": [ { "db": "CNNVD", "id": "CNNVD-202209-835" } ], "trust": 0.6 } }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.