USN-6578-1 — dotnet6, dotnet7, dotnet8 vulnerabilities

Summary

Vishal Mishra and Anita Gaud discovered that .NET did not properly
validate X.509 certificates with malformed signatures. An attacker
could possibly use this issue to bypass an application's typical
authentication logic.
(CVE-2024-0057)

Morgan Brown discovered that .NET did not properly handle requests from
unauthenticated clients. An attacker could possibly use this issue to
cause a denial of service.
(CVE-2024-21319)

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 22.04 LTS 22.04:LTS	dotnet6	6.0.126-0ubuntu1~22.04.1
Ubuntu · 22.04 LTS 22.04:LTS	dotnet7	7.0.115-0ubuntu1~22.04.1

Vulnerabilities 2

Critical 9.1

CVE-2024-0057

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jan 9, 2024
Medium 6.8

CVE-2024-21319

Microsoft Identity Denial of service vulnerability

Microsoft Identity Denial of service vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine NuGet

Jan 9, 2024

References

report
https://ubuntu.com/security/CVE-2024-0057
report
https://ubuntu.com/security/CVE-2024-21319

dotnet6, dotnet7, dotnet8 vulnerabilities

Summary

Fixed packages 2

Vulnerabilities 2

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Microsoft Identity Denial of service vulnerability

References