ALAS2023-2025-844 — Important: dotnet8.0 security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21176: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2025-21173: .NET Elevation of Privilege Vulnerability CVE-2025-21172: .NET and Visual Studio Remote Code Execution Vulnerability

Fixed packages 22

Release	Package	Fixed in
Amazon Linux · 2023	aspnetcore-runtime-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	aspnetcore-runtime-dbg-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	aspnetcore-targeting-pack-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet-apphost-pack-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-apphost-pack-8.0-debuginfo	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-host	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-host-debuginfo	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-hostfxr-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-hostfxr-8.0-debuginfo	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-runtime-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-runtime-8.0-debuginfo	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-runtime-dbg-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-sdk-8.0	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet-sdk-8.0-debuginfo	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet-sdk-8.0-source-built-artifacts	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet-sdk-dbg-8.0	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet-targeting-pack-8.0	0:8.0.12-1.amzn2023
Amazon Linux · 2023	dotnet-templates-8.0	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet8.0-debuginfo	0:8.0.112-1.amzn2023
Amazon Linux · 2023	dotnet8.0-debugsource	0:8.0.112-1.amzn2023
Amazon Linux · 2023	netstandard-targeting-pack-2.1	0:8.0.112-1.amzn2023

Vulnerabilities 3

High 8.8

CVE-2025-21176

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.5

CVE-2025-21172

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.3

CVE-2025-21173

.NET Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 Microsoft Visual Studio 2022 version 17.12 Ubuntu Alpine Wolfi

Jan 14, 2025

References

web
https://alas.aws.amazon.com/cve/html/CVE-2025-21172.html
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21173.html
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21176.html