USN-6634-1 — dotnet6, dotnet7, dotnet8 vulnerabilities

Summary

Brennan Conroy discovered that .NET with SignalR did not properly
handle malicious clients. An attacker could possibly use this issue
to cause a denial of service. (CVE-2024-21386)

Bahaa Naamneh discovered that .NET with OpenSSL support did not
properly parse X509 certificates. An attacker could possibly use
this issue to cause a denial of service. (CVE-2024-21404)

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 22.04 LTS 22.04:LTS	dotnet6	6.0.127-0ubuntu1~22.04.1
Ubuntu · 22.04 LTS 22.04:LTS	dotnet7	7.0.116-0ubuntu1~22.04.1
Ubuntu · 22.04 LTS 22.04:LTS	dotnet8	8.0.102-8.0.2-0ubuntu1~22.04.1

Vulnerabilities 2

High 7.5

CVE-2024-21386

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine NuGet

Feb 13, 2024
High 7.5

CVE-2024-21404

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine

Feb 13, 2024

References

report
https://ubuntu.com/security/CVE-2024-21386
report
https://ubuntu.com/security/CVE-2024-21404