RHBA-2025:0304 — Red Hat Bug Fix Advisory: .NET 8.0 bug fix and enhancement update

Fixed packages 25

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	aspnetcore-runtime-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	aspnetcore-runtime-dbg-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	aspnetcore-targeting-pack-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-apphost-pack-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-apphost-pack-8.0-debuginfo	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-hostfxr-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-hostfxr-8.0-debuginfo	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-runtime-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-runtime-8.0-debuginfo	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-runtime-dbg-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-sdk-8.0	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-sdk-8.0-debuginfo	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-sdk-dbg-8.0	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-targeting-pack-8.0	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet-templates-8.0	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet8.0	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet8.0-debuginfo	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::appstream	dotnet8.0-debugsource	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet-apphost-pack-8.0-debuginfo	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet-hostfxr-8.0-debuginfo	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet-runtime-8.0-debuginfo	0:8.0.12-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet-sdk-8.0-debuginfo	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet-sdk-8.0-source-built-artifacts	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet8.0-debuginfo	0:8.0.112-1.el9_5
Red Hat · RHEL 9 enterprise_linux:9::crb	dotnet8.0-debugsource	0:8.0.112-1.el9_5

Vulnerabilities 4

High 8.8

CVE-2025-21176

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.5

CVE-2025-21172

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.3

CVE-2025-21173

.NET Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 Microsoft Visual Studio 2022 version 17.12 Ubuntu Alpine Wolfi

Jan 14, 2025
Medium 5.4

CVE-2024-11831

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu npm

Feb 10, 2025

References

advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_0304.json
report
https://access.redhat.com/security/cve/CVE-2024-11831
report
https://bugzilla.redhat.com/show_bug.cgi?id=2312579
advisory
https://www.cve.org/CVERecord?id=CVE-2024-11831
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-11831
article
https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e
article
https://github.com/yahoo/serialize-javascript/pull/173
report
https://access.redhat.com/security/cve/CVE-2025-21172
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337927
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21172
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21172
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21172
report
https://access.redhat.com/security/cve/CVE-2025-21173
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337893
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21173
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21173
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21173
report
https://access.redhat.com/security/cve/CVE-2025-21176
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337926
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21176
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21176
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176

Red Hat Bug Fix Advisory: .NET 8.0 bug fix and enhancement update

Fixed packages 25

Vulnerabilities 4

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

.NET Elevation of Privilege Vulnerability

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

References