.NET Information Disclosure Vulnerability

2022-08-1000:00:18

Google

osv.dev

0.001 Low

EPSS

Percentile

47.0%

JSON

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

Any .NET 6.0 application running on .NET 6.0.7 or earlier.
Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

If you’re using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
If you’re using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.

CPENameOperatorVersion
microsoft.aspnetcore.app.runtime.linux-musl-armeq6.0.4
microsoft.aspnetcore.app.runtime.linux-musl-x64eq3.1.27
microsoft.aspnetcore.app.runtime.linux-musl-x64eq3.1.10
microsoft.aspnetcore.app.runtime.linux-musl-arm64eq3.1.5
microsoft.aspnetcore.app.runtime.linux-x64eq6.0.3
microsoft.aspnetcore.app.runtime.linux-musl-x64eq3.1.7
microsoft.aspnetcore.app.runtime.linux-x64eq3.1.5
microsoft.aspnetcore.app.runtime.win-x64eq3.1.27
microsoft.aspnetcore.app.runtime.win-x64eq3.1.10
microsoft.aspnetcore.app.runtime.linux-armeq3.1.25

Name	Operator	Version
microsoft.aspnetcore.app.runtime.linux-musl-arm	eq	6.0.4
microsoft.aspnetcore.app.runtime.linux-musl-x64	eq	3.1.27
microsoft.aspnetcore.app.runtime.linux-musl-x64	eq	3.1.10
microsoft.aspnetcore.app.runtime.linux-musl-arm64	eq	3.1.5
microsoft.aspnetcore.app.runtime.linux-x64	eq	6.0.3
microsoft.aspnetcore.app.runtime.linux-musl-x64	eq	3.1.7
microsoft.aspnetcore.app.runtime.linux-x64	eq	3.1.5
microsoft.aspnetcore.app.runtime.win-x64	eq	3.1.27
microsoft.aspnetcore.app.runtime.win-x64	eq	3.1.10
microsoft.aspnetcore.app.runtime.linux-arm	eq	3.1.25