RHSA-2025:0382 — Red Hat Security Advisory: .NET 9.0 security update

Fixed packages 33

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	aspnetcore-runtime-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	aspnetcore-runtime-dbg-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	aspnetcore-targeting-pack-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-apphost-pack-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-apphost-pack-9.0-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-host	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-host-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-hostfxr-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-hostfxr-9.0-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-runtime-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-runtime-9.0-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-runtime-dbg-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-sdk-9.0	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-sdk-9.0-debuginfo	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-sdk-aot-9.0	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-sdk-aot-9.0-debuginfo	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-sdk-dbg-9.0	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-targeting-pack-9.0	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet-templates-9.0	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet9.0	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet9.0-debuginfo	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	dotnet9.0-debugsource	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	netstandard-targeting-pack-2.1	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-apphost-pack-9.0-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-host-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-hostfxr-9.0-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-runtime-9.0-debuginfo	0:9.0.1-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-sdk-9.0-debuginfo	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-sdk-9.0-source-built-artifacts	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet-sdk-aot-9.0-debuginfo	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet9.0-debuginfo	0:9.0.102-1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb	dotnet9.0-debugsource	0:9.0.102-1.el8_10

Vulnerabilities 4

High 8.8

CVE-2025-21176

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.5

CVE-2025-21171

.NET Remote Code Execution Vulnerability

.NET Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 Microsoft Visual Studio 2022 version 17.12 Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.5

CVE-2025-21172

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Ubuntu Alpine Wolfi NuGet

Jan 14, 2025
High 7.3

CVE-2025-21173

.NET Elevation of Privilege Vulnerability

.NET Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 Microsoft Visual Studio 2022 version 17.12 Ubuntu Alpine Wolfi

Jan 14, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337893
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337926
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337927
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337958
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0382.json
report
https://access.redhat.com/security/cve/CVE-2025-21171
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21171
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21171
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21171
report
https://access.redhat.com/security/cve/CVE-2025-21172
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21172
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21172
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21172
report
https://access.redhat.com/security/cve/CVE-2025-21173
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21173
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21173
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21173
report
https://access.redhat.com/security/cve/CVE-2025-21176
advisory
https://www.cve.org/CVERecord?id=CVE-2025-21176
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-21176
article
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176

Red Hat Security Advisory: .NET 9.0 security update

Fixed packages 33

Vulnerabilities 4

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

.NET Elevation of Privilege Vulnerability

References