-----BEGIN PGP SIGNATURE-----
wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmXL6noFAwAAAAAACgkQa1+PL+d1/Ega
6AwAuasEu/pFQN8fQq4elibSRJ2oEhHOUZv1nF/Ehde80QbzT03Jdn0OPw4qjp8GJ2EtKzkrz3Iz
0n1QvMn0TZvi8a7k6YMjIWFzYbtQe9zBbt7wduTx6cPWftMLuze2Kq55s1CRPouzlScRz4pGv5xm
A+BucRvJ35Ryhc8BvKLl0b3phN2adMNmZsLvP8MMvY8GJvpZQfsHobcC/alj6lNUO0c0kmuqPcaU
Syn9TrIcJg2aqavx0TFYzSxaC9A32Mi2ufSOWk9O/QnzaXo7qW8QJmDZbUp2ABtE5C3ovZYtle1C
48y0fLZcheQzVo4Ci8ccKoNfpKDQW90QutOA53lrEEz434O/YtybV+jQFMq2KlSWG7J1FIccuPnK
G7+/bF2a7Ghd/r/DT7zaLimYY6h1WDZ3ywRmR2XLVyoEQdjCrO/veRwd/GMqeV+rFcCbf5F4Kj9q
JzYLA7MwWZiZcHYR0jG6bMJeAt2yNnIDPAhQDJ2j444JTnOLrhGmca6BdYeX
=0au2
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6634-1
February 13, 2024
dotnet6, dotnet7, dotnet8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in .NET.
Software Description:
- dotnet6: dotNET CLI tools and runtime
- dotnet7: dotNET CLI tools and runtime
- dotnet8: dotNET CLI tools and runtime
Details:
Brennan Conroy discovered that .NET with SignalR did not properly
handle malicious clients. An attacker could possibly use this issue
to cause a denial of service. (CVE-2024-21386)
Bahaa Naamneh discovered that .NET with OpenSSL support did not
properly parse X509 certificates. An attacker could possibly use
this issue to cause a denial of service. (CVE-2024-21404)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
aspnetcore-runtime-6.0 6.0.127-0ubuntu1~23.10.1
aspnetcore-runtime-7.0 7.0.116-0ubuntu1~23.10.1
aspnetcore-runtime-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-host 6.0.127-0ubuntu1~23.10.1
dotnet-host-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-host-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-hostfxr-6.0 6.0.127-0ubuntu1~23.10.1
dotnet-hostfxr-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-hostfxr-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-runtime-6.0 6.0.127-0ubuntu1~23.10.1
dotnet-runtime-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-runtime-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-sdk-6.0 6.0.127-0ubuntu1~23.10.1
dotnet-sdk-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-sdk-8.0 8.0.102-0ubuntu1~23.10.1
dotnet6 6.0.127-0ubuntu1~23.10.1
dotnet7 7.0.116-0ubuntu1~23.10.1
dotnet8 8.0.102-8.0.2-0ubuntu1~23.10.1
Ubuntu 22.04 LTS:
aspnetcore-runtime-6.0 6.0.127-0ubuntu1~22.04.1
aspnetcore-runtime-7.0 7.0.116-0ubuntu1~22.04.1
aspnetcore-runtime-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-host 6.0.127-0ubuntu1~22.04.1
dotnet-host-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-host-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-hostfxr-6.0 6.0.127-0ubuntu1~22.04.1
dotnet-hostfxr-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-hostfxr-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-runtime-6.0 6.0.127-0ubuntu1~22.04.1
dotnet-runtime-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-runtime-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-sdk-6.0 6.0.127-0ubuntu1~22.04.1
dotnet-sdk-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-sdk-8.0 8.0.102-0ubuntu1~22.04.1
dotnet6 6.0.127-0ubuntu1~22.04.1
dotnet7 7.0.116-0ubuntu1~22.04.1
dotnet8 8.0.102-8.0.2-0ubuntu1~22.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6634-1
CVE-2024-21386, CVE-2024-21404
Package Information:
https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~22.04.1
No comments:
Post a Comment