.NETに脆弱性、認証なしの攻撃でサービスが停止のおそれ
Summary
.NETのLinux版で、スタックベースのバッファオーバーフローの脆弱性が見つかりました。認証を受けていない攻撃者がネットワーク越しにサービス拒否の状態を引き起こすおそれがあり、CVSSは7.5です。影響を受けるのは.NET 8.0・9.0・10.0・11.0のプレビュー版で、修正版は8.0.34・9.0.23・10.0.15・11.0.0です。該当する版を使っている場合は、修正版への更新を急ぎましょう。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
.NETのLinux版で、スタックベースのバッファオーバーフローの脆弱性が見つかりました。認証を受けていない攻撃者がネットワーク越しにサービス拒否の状態を引き起こすおそれがあり、CVSSは7.5です。影響を受けるのは.NET 8.0・9.0・10.0・11.0のプレビュー版で、修正版は8.0.34・9.0.23・10.0.15・11.0.0です。該当する版を使っている場合は、修正版への更新を急ぎましょう。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Microsoft.NET 10.0 installed on Linux |
≥ 10.0.0, < 10.0.15→ 10.0.15 |
10.0.15 |
| Microsoft.NET 11.0 installed on Linux |
≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0 |
11.0.0 |
| Microsoft.NET 8.0 installed on Linux |
≥ 8.0.0, < 8.0.34→ 8.0.34 |
8.0.34 |
| Microsoft.NET 9.0 installed on Linux |
≥ 9.0.0, < 9.0.23→ 9.0.23 |
9.0.23 |
| Microsoft.NET 10.0 installed on Mac OS |
≥ 10.0.0, < 10.0.15→ 10.0.15 |
10.0.15 |
| Microsoft.NET 11.0 installed on Mac OS |
≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0 |
11.0.0 |
| Microsoft.NET 8.0 installed on Mac OS |
≥ 8.0.0, < 8.0.34→ 8.0.34 |
8.0.34 |
| Microsoft.NET 9.0 installed on Mac OS |
≥ 9.0.0, < 9.0.23→ 9.0.23 |
9.0.23 |
| NuGetMicrosoft.NETCore.App.Runtime.linux-arm |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.linux-arm64 |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.linux-musl-arm |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.linux-musl-arm64 |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.linux-musl-x64 |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.linux-x64 |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.osx-arm64 |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
| NuGetMicrosoft.NETCore.App.Runtime.osx-x64 |
≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0 |
11.0.0 |
Original description The description as published by the source.
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
Managed HttpListener can recursively process an unterminated request line and exhaust the process stack.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/500
CVSS Details
- Version: 3.1
- Severity: High
- Score: 7.5 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-121
Affected Platforms
- Platforms: Linux, macOS
- Architectures: All
Affected Packages
The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.
.NET 8.0 - affected runtime packages
| Package | Affected version | Patched version |
|---|---|---|
| Microsoft.NETCore.App.Runtime.linux-arm | >= 8.0.0-0, <= 8.0.33 | 8.0.34 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | >= 8.0.0-0, <= 8.0.33 | 8.0.34 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 8.0.0-0, <= 8.0.33 | 8.0.34 |
| [Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.… |
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- package github.com
- REDHAT Red Hat
- web msrc.microsoft.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com