ALAS2023-2023-242 — Important: dotnet6.0 security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33135: .NET and Visual Studio Elevation of Privilege Vulnerability CVE-2023-32032: .NET and Visual Studio Elevation of Privilege Vulnerability CVE-2023-29337: NuGet Client Remote Code Execution Vulnerability CVE-2023-29331: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2023-24936: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2023-24895: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2023-21538: .NET Denial of Service Vulnerability.

Fixed packages 19

Release	Package	Fixed in
Amazon Linux · 2023	aspnetcore-runtime-6.0	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	aspnetcore-targeting-pack-6.0	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-apphost-pack-6.0	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-apphost-pack-6.0-debuginfo	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-host	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-host-debuginfo	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-hostfxr-6.0	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-hostfxr-6.0-debuginfo	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-runtime-6.0	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-runtime-6.0-debuginfo	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0-debuginfo	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0-source-built-artifacts	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-targeting-pack-6.0	0:6.0.18-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-templates-6.0	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	dotnet6.0-debuginfo	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	dotnet6.0-debugsource	0:6.0.118-1.amzn2023.0.1
Amazon Linux · 2023	netstandard-targeting-pack-2.1	0:6.0.118-1.amzn2023.0.1

Vulnerabilities 7

High 7.8

CVE-2023-24895

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-21538

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

Microsoft .NET 6.0 PowerShell 7.2 dotnet6 Ubuntu Alpine NuGet

Jan 10, 2023
High 7.5

CVE-2023-24936

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-29331

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.3

CVE-2023-33135

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine

Jun 13, 2023
High 7.1

CVE-2023-29337

NuGet Client Remote Code Execution Vulnerability

NuGet Client Remote Code Execution Vulnerability

Microsoft NuGet 6.6.0 NuGet 6.2.3 NuGet 6.5.0 Debian Ubuntu Alpine NuGet

Jun 14, 2023
Medium 6.5

CVE-2023-32032

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine

Jun 13, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-21538.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-24895.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-24936.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-29331.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-29337.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-32032.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-33135.html