USN-6480-1 — dotnet6, dotnet7, dotnet8 vulnerabilities

Summary

Barry Dorrans discovered that .NET did not properly implement certain
security features for Blazor server forms. An attacker could possibly
use this issue to bypass validation, which could trigger unintended
actions. (CVE-2023-36558)

Piotr Bazydlo discovered that .NET did not properly handle untrusted
URIs provided to System.Net.WebRequest.Create. An attacker could possibly
use this issue to inject arbitrary commands to backend FTP servers.
(CVE-2023-36049)

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 22.04 LTS 22.04:LTS	dotnet6	6.0.125-0ubuntu1~22.04.1
Ubuntu · 22.04 LTS 22.04:LTS	dotnet7	7.0.114-0ubuntu1~22.04.1

Vulnerabilities 2

High 7.6

CVE-2023-36049

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Nov 14, 2023
Medium 6.2

CVE-2023-36558

ASP.NET Core Security Feature Bypass Vulnerability

ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Nov 14, 2023

References

report
https://ubuntu.com/security/CVE-2023-36049
report
https://ubuntu.com/security/CVE-2023-36558

dotnet6, dotnet7, dotnet8 vulnerabilities

Summary

Fixed packages 2

Vulnerabilities 2

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

ASP.NET Core Security Feature Bypass Vulnerability

References