Affected: AlmaLinux:9: aspnetcore-runtime-6.0, AlmaLinux:9: aspnetcore-targeting-pack-6.0, AlmaLinux:9: dotnet-apphost-pack-6.0, AlmaLinux:9: dotnet-hostfxr-6.0, AlmaLinux:9: dotnet-runtime-6.0, AlmaLinux:9: dotnet-sdk-6.0, AlmaLinux:9: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:9: dotnet-targeting-pack-6.0, AlmaLinux:9: dotnet-templates-6.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.113 and .NET Runtime 6.0.13.

The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.113). (BZ#2154459)

Security Fix(es):

* dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process (CVE-2023-21538)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Bitnami: dotnet

.NET Denial of Service Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime

CVE-2023-21538 affects multiple packages. . See references for individual vulnerability details.

.NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.NETCore.App.Runtime.linux-arm, NuGet: Microsoft.NETCore.App.Runtime.linux-arm64, NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NETCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NETCore.App.Runtime.linux-x64, NuGet: Microsoft.NETCore.App.Runtime.osx-arm64, NuGet: Microsoft.NETCore.App.Runtime.osx-x64, NuGet: Microsoft.NETCore.App.Runtime.win-arm, NuGet: Microsoft.NETCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2023-21538: .NET Denial of Service Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends an invalid request to an exposed endpoint. ## Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/80449

### <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 6.0 application running on .NET 6.0.12 or earlier.

If your application uses the following package versions, ensure you update to the latest version of .NET.

### <a name=".NET 6"></a>.NET 6

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm)|>= 6.0.0, <= 6.0.12|6.0.13 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64)|>= 6.0.0, <= 6.0.12|6.0.13 [Microsoft.NetCore.App…

security update for dotnet6.0

dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process

Affected: Ubuntu:22.04:LTS: dotnet6

.NET Denial of Service Vulnerability

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Developer Tools ausnutzen, um einen Denial of Service Angriff durchzuführen.