(RHSA-2023:5142) Moderate: .NET 6.0 security and bug fix update

2023-09-1309:19:20

access.redhat.com

.netmanaged-softwaresdkruntimesecurityvulnerabilitybug fixunix.

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

28.8%

JSON

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.122 and .NET Runtime 6.0.22.

Security Fix(es):

dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Update .NET 6.0 to SDK 6.0.122 and Runtime 6.0.22 (BZ#2236895)

OSVersionArchitecturePackageVersionFilename
RedHat7x86_64rh-dotnet60-aspnetcore-runtime-6.0< 6.0.22-1.el7_9rh-dotnet60-aspnetcore-runtime-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet-hostfxr-6.0< 6.0.22-1.el7_9rh-dotnet60-dotnet-hostfxr-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet< 6.0.122-1.el7_9rh-dotnet60-dotnet-6.0.122-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-aspnetcore-targeting-pack-6.0< 6.0.22-1.el7_9rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-netstandard-targeting-pack-2.1< 6.0.122-1.el7_9rh-dotnet60-netstandard-targeting-pack-2.1-6.0.122-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts< 6.0.122-1.el7_9rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.122-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet-targeting-pack-6.0< 6.0.22-1.el7_9rh-dotnet60-dotnet-targeting-pack-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet-host< 6.0.22-1.el7_9rh-dotnet60-dotnet-host-6.0.22-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet-apphost-pack-6.0< 6.0.22-1.el7_9rh-dotnet60-dotnet-apphost-pack-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat7x86_64rh-dotnet60-dotnet-debuginfo< 6.0.122-1.el7_9rh-dotnet60-dotnet-debuginfo-6.0.122-1.el7_9.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	7	x86_64	rh-dotnet60-aspnetcore-runtime-6.0	< 6.0.22-1.el7_9	rh-dotnet60-aspnetcore-runtime-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet-hostfxr-6.0	< 6.0.22-1.el7_9	rh-dotnet60-dotnet-hostfxr-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet	< 6.0.122-1.el7_9	rh-dotnet60-dotnet-6.0.122-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-aspnetcore-targeting-pack-6.0	< 6.0.22-1.el7_9	rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-netstandard-targeting-pack-2.1	< 6.0.122-1.el7_9	rh-dotnet60-netstandard-targeting-pack-2.1-6.0.122-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts	< 6.0.122-1.el7_9	rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts-6.0.122-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet-targeting-pack-6.0	< 6.0.22-1.el7_9	rh-dotnet60-dotnet-targeting-pack-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet-host	< 6.0.22-1.el7_9	rh-dotnet60-dotnet-host-6.0.22-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet-apphost-pack-6.0	< 6.0.22-1.el7_9	rh-dotnet60-dotnet-apphost-pack-6.0-6.0.22-1.el7_9.x86_64.rpm
RedHat	7	x86_64	rh-dotnet60-dotnet-debuginfo	< 6.0.122-1.el7_9	rh-dotnet60-dotnet-debuginfo-6.0.122-1.el7_9.x86_64.rpm