Most recent entries from all

ALSA-2022:2199 — Important: .NET 6.0 security, bug fix, and enhancement update

Affected: AlmaLinux:8: aspnetcore-runtime-6.0, AlmaLinux:8: aspnetcore-targeting-pack-6.0, AlmaLinux:8: dotnet, AlmaLinux:8: dotnet-apphost-pack-6.0, AlmaLinux:8: dotnet-host, AlmaLinux:8: dotnet-hostfxr-6.0, AlmaLinux:8: dotnet-runtime-6.0, AlmaLinux:8: dotnet-sdk-6.0, AlmaLinux:8: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-6.0 and 2 more

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET Core that address a security vulnerability are now available. The updated versions are .NET Core SDK 6.0.105 and .NET Core Runtime 6.0.5.

Security Fix(es):

* dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

* dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

* dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-05514

BIT-dotnet-2022-29145 — .NET and Visual Studio Denial of Service Vulnerability

Affected: Bitnami: dotnet

.NET and Visual Studio Denial of Service Vulnerability

certfr-2022-avi-449 — De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un at…

certfr-2022-avi-449

cnvd-2022-60133

EUVD-2026-321964

fkie_cve-2022-29145

.NET and Visual Studio Denial of Service Vulnerability

GHSA-fcg8-mg9g-6hc4 — .NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.win-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-x86, NuGet: Microsoft.AspNetCore.App.Runtime.osx-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 and 1 more

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 6.0, .NET 5.0 and .NET core 3.1 where a malicious client can can cause a denial of service when HTML forms are parsed.

### Affected software

* Any .NET 6.0 application running on .NET 6.0.4 or earlier. * Any .NET 5.0 application running .NET 5.0.16 or earlier. * Any .NET Core 3.1 application running on .NET Core 3.1.24 or earlier.

#### Affected packages

**.NET Core 3.1**

| Package name | Affected version | Patched version | |---------------------------------------------------|---------------------|---------------| | Microsoft.AspNetCore.App.Runtime.win-x64 | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft.AspNetCore.App.Runtime.linux-x64 | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft.AspNetCore.App.Runtime.win-x86 | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft.AspNetCore.App.Runtime.osx-x64 | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft.AspNetCore.App.Runtime.linux-arm64 | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft.AspNetCore.App.Runtime.linux-arm | >=3.0.0,3.1.24 | 3.1.25 | | Microsoft…

gsd-2022-29145

msrc_CVE-2022-29145 — .NET and Visual Studio Denial of Service Vulnerability

msrc_CVE-2022-29145

RHSA-2022:2194 — Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update

dotnet: excess memory allocation via HttpClient causes DoS dotnet: malicious content causes high CPU and memory usage dotnet: parsing HTML causes Denial of Service

RHSA-2022:2199 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

dotnet: excess memory allocation via HttpClient causes DoS dotnet: malicious content causes high CPU and memory usage dotnet: parsing HTML causes Denial of Service