ALAS2023-2024-489 — Important: dotnet6.0 security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21319: Microsoft Identity Denial of service vulnerability CVE-2024-0057: NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Fixed packages 19

Release	Package	Fixed in
Amazon Linux · 2023	aspnetcore-runtime-6.0	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	aspnetcore-targeting-pack-6.0	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-apphost-pack-6.0	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-apphost-pack-6.0-debuginfo	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-host	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-host-debuginfo	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-hostfxr-6.0	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-hostfxr-6.0-debuginfo	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-runtime-6.0	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-runtime-6.0-debuginfo	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0-debuginfo	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0-source-built-artifacts	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-targeting-pack-6.0	0:6.0.26-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-templates-6.0	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	dotnet6.0-debuginfo	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	dotnet6.0-debugsource	0:6.0.126-1.amzn2023.0.1
Amazon Linux · 2023	netstandard-targeting-pack-2.1	0:6.0.126-1.amzn2023.0.1

Vulnerabilities 3

Critical 9.1

CVE-2024-0057

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jan 9, 2024
High 8.7

CVE-2024-0056

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft Microsoft SQL Server 2022 (GDR) Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Jan 9, 2024
Medium 6.8

CVE-2024-21319

Microsoft Identity Denial of service vulnerability

Microsoft Identity Denial of service vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine NuGet

Jan 9, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-0056.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-0057.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-21319.html