Lucene search
GitHub Advisory DatabaseGHSA-VH55-786G-WJWJHistoryFeb 03, 2024 - 12:47 a.m.
.NET Information Disclosure Vulnerability
2024-02-0300:47:54
GitHub Advisory Database
github.com
90
.net core
.net 6.0
information disclosure
vulnerability
unauthorized access
update applications
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
6.2
Confidence
Low
EPSS
0.001
Percentile
46.8%
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.
<a></a>Affected software
- Any .NET 6.0 application running on .NET 6.0.7 or earlier.
- Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.
If your application uses the following package versions, ensure you update to the latest version of .NET.
<a></a>.NET Core 3.1
| Package name | Affected version | Patched version |
|---|---|---|
| System.Security.Cryptography.Xml | <=4.7.0 | 4.7.1 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >=3.1.0, 3.1.27 | 3.1.28 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >=3.1.0, 3.1.27 | 3.1.28 |
<a></a>.NET 6
| Package name | Affected version | Patched version |
|---|---|---|
| System.Security.Cryptography.Xml | >=5.0.0, 6.0.0 | 6.0.1 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >=6.0.0, 6.0.7 | 6.0.8 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >=6.0.0, 6.0.7 | 6.0.8 |
Patches
- If you’re using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
- If you’re using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
Other
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/232
An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/43166
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34716
Affected configurations
Node
microsoftaspnetcore.app.runtime.linux-musl-armRange6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.linux-musl-armRange3.1.0–3.1.27
ORmicrosoftaspnetcore.app.runtime.linux-musl-arm64Range6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.linux-musl-arm64Range3.1.0–3.1.27
ORmicrosoftaspnetcore.app.runtime.osx-arm64Range6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.win-armRange6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.win-armRange3.1.0–3.1.27
ORmicrosoftaspnetcore.app.runtime.win-arm64Range6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.win-arm64Range3.1.0–3.1.27
ORmicrosoftaspnetcore.app.runtime.linux-armRange6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.linux-armRange3.1.0–3.1.27
ORmicrosoftaspnetcore.app.runtime.linux-arm64Range6.0.0–6.0.7
ORmicrosoftaspnetcore.app.runtime.linux-arm64Range3.1.0–3.1.27
ORmicrosoftwordRange6.0.0–6.0.7x64
ORmicrosoftwordRange3.1.0–3.1.27x64
ORmicrosoftwordRange6.0.0–6.0.7x64
ORmicrosoftwordRange3.1.0–3.1.27x64
ORmicrosoftpublisherRange6.0.0–6.0.7x86
ORmicrosoftpublisherRange3.1.0–3.1.27x86
ORmicrosoftwordRange6.0.0–6.0.7x64
ORmicrosoftwordRange3.1.0–3.1.27x64
ORmicrosoftwordRange6.0.0–6.0.7x64
ORmicrosoftwordRange3.1.0–3.1.27x64
ORsystem.security.cryptography.xmlRange5.0.0–6.0.0
ORsystem.security.cryptography.xmlRange≤4.7.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| microsoft | aspnetcore.app.runtime.linux-musl-arm | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.linux-musl-arm:*:*:*:*:*:*:*:* |
| microsoft | aspnetcore.app.runtime.linux-musl-arm64 | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.linux-musl-arm64:*:*:*:*:*:*:*:* |
| microsoft | aspnetcore.app.runtime.osx-arm64 | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.osx-arm64:*:*:*:*:*:*:*:* |
| microsoft | aspnetcore.app.runtime.win-arm | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.win-arm:*:*:*:*:*:*:*:* |
| microsoft | aspnetcore.app.runtime.win-arm64 | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.win-arm64:*:*:*:*:*:*:*:* |
| microsoft | aspnetcore.app.runtime.linux-arm | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.linux-arm:*:*:*:*:*:*:*:* |
| microsoft | aspnetcore.app.runtime.linux-arm64 | * | cpe:2.3:a:microsoft:aspnetcore.app.runtime.linux-arm64:*:*:*:*:*:*:*:* |
| microsoft | word | * | cpe:2.3:a:microsoft:word:*:*:*:*:*:*:x64:* |
| microsoft | publisher | * | cpe:2.3:a:microsoft:publisher:*:*:*:*:*:*:x86:* |
| * | system.security.cryptography.xml | * | cpe:2.3:a:*:system.security.cryptography.xml:*:*:*:*:*:*:*:* |
References
github.com/advisories/GHSA-vh55-786g-wjwj
github.com/dotnet/announcements/issues/232
github.com/dotnet/aspnetcore/issues/43166
github.com/dotnet/aspnetcore/security/advisories/GHSA-vh55-786g-wjwj
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34716
nvd.nist.gov/vuln/detail/CVE-2022-34716
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-34716
Related
osv
osv
Moderate: .NET 6.0 security, bug fix, and enhancement update
2022-08-15 00:00:00
Moderate: .NET Core 3.1 security, bug fix, and enhancement update
2022-08-15 00:00:00
Moderate: .NET 6.0 security, bug fix, and enhancement update
2022-08-10 00:00:00
nessus
nessus
RHEL 8 : .NET 6.0 (RHSA-2022:6058)
2022-08-15 00:00:00
AlmaLinux 8 : .NET Core 3.1 (6057) (ALSA-2022:6057)
2022-08-18 00:00:00
Oracle Linux 9 : .NET / 6.0 (ELSA-2022-6043)
2022-08-10 00:00:00
alpinelinux
alpinelinux
CVE-2022-34716
2022-08-09 20:15:11
nvd
nvd
CVE-2022-34716
2022-08-09 20:15:11
almalinux
almalinux
Moderate: .NET 6.0 security, bug fix, and enhancement update
2022-08-15 00:00:00
Moderate: .NET 6.0 security, bug fix, and enhancement update
2022-08-10 00:00:00
Moderate: .NET Core 3.1 security, bug fix, and enhancement update
2022-08-15 00:00:00
openvas
openvas
.NET Core Information Disclosure Vulnerabilities - Windows
2022-08-10 00:00:00
redhat
redhat
ibm
ibm
oraclelinux
oraclelinux
.NET Core 3.1 security, bug fix, and enhancement update
2022-08-15 00:00:00
.NET 6.0 security, bug fix, and enhancement update
2022-08-10 00:00:00
.NET 6.0 security, bug fix, and enhancement update
2022-08-15 00:00:00
mscve
mscve
.NET Spoofing Vulnerability
2022-08-09 07:00:00
cve
cve
CVE-2022-34716
2022-08-09 20:15:11
redhatcve
redhatcve
CVE-2022-34716
2022-08-09 17:25:00
redos
redos
ROS-20240226-02
2024-02-26 00:00:00
prion
prion
Spoofing
2022-08-09 20:15:00
cvelist
cvelist
CVE-2022-34716 .NET Spoofing Vulnerability
2022-08-09 19:55:43
mskb
mskb
.NET 6.0 Update - August 9, 2022 (KB5016990)
2022-08-09 07:00:00
.NET Core 3.1 Update - August 9, 2022 (KB5016987)
2022-08-09 07:00:00
veracode
veracode
Information Disclosure
2022-08-12 07:49:39
cbl_mariner
cbl_mariner
CVE-2022-34716 affecting package powershell 7.2.2-1
2022-10-04 07:51:34
rocky
rocky
.NET 6.0 security, bug fix, and enhancement update
2022-08-15 07:40:49
.NET Core 3.1 security, bug fix, and enhancement update
2022-08-15 07:23:44
altlinux
altlinux
kaspersky
kaspersky
KLA12605 Multiple vulnerabilities in Microsoft Developer Tools
2022-08-09 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-4.0-0279
2022-11-10 00:00:00
rapid7blog
rapid7blog
Patch Tuesday - August 2022
2022-08-09 19:34:51
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
6.2
Confidence
Low
EPSS
0.001
Percentile
46.8%
Related for GHSA-VH55-786G-WJWJ