Summary
McKee-Harris, Matt Cotterell, and Jack Moran discovered that .NET did
not properly update account lockout maximum failed attempts. An
attacker could possibly use this issue to bypass the security feature
and attempt to guess more passwords for an account.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet6 | 6.0.120-0ubuntu1~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet7 | 7.0.109-0ubuntu1~22.04.1 |
Vulnerabilities 1
-
High 8.1
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
References
-
report
https://ubuntu.com/security/CVE-2023-33170