Most recent entries from all

ALSA-2024:0150 — Important: .NET 8.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-host, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1.

Security Fix(es):

* dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-00402

BIT-dotnet-2024-0057 — NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Affected: Bitnami: dotnet

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

certfr-2024-avi-0022 — De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un at…

certfr-2024-avi-0022

CLEANSTART-2025-FM16465 — NET,

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime

CVE-2024-0057 affects multiple packages. NET,. See references for individual vulnerability details.

EUVD-2026-242685

fkie_cve-2024-0057

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

GHSA-68w7-72jg-6qpp — NuGet Client Security Feature Bypass Vulnerability

Affected: NuGet: NuGet.CommandLine, NuGet: NuGet.Packaging

### Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A security feature bypass vulnerability exists when Microsoft .NET Framework-based applications use X.509 chain building APIs but do not completely validate the X.509 certificate due to a logic flaw. An attacker could present an arbitrary untrusted certificate with malformed signatures, triggering a bug in the framework. The framework will correctly report that X.509 chain building failed, but it will return an incorrect reason code for the failure. Applications which utilize this reason code to make their own chain building trust decisions may inadvertently treat this scenario as a successful chain build. This could allow an adversary to subvert the app's typical authentication logic.

### Affected software #### NuGet & NuGet Packages - Any NuGet.exe, NuGet.CommandLine, NuGet.Packaging 6.8.0 version or earlier. - Any NuGet.exe, NuGet.CommandLine, NuGet.Packaging 6.7.0 version or earlier. - Any NuGet.exe, NuGet.CommandLine, NuGet.Packaging 6.6.1 version or earlier. - Any NuGet.exe, NuGet.CommandLine, NuGet.Packaging 6.4.2 version or earlier. - Any NuGet.exe, NuGet.CommandLine, NuGet.Packaging 6.3.3 version or earlier. - Any NuGet.exe, NuGet.CommandLine, NuGet.Packaging 6.0.5 version or earlier. - Any NuGe…

gsd-2024-0057

msrc_CVE-2024-0057 — NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

msrc_CVE-2024-0057

RHSA-2024:0150 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) dotnet: X509 Certificates - Validation Bypass across Azure dotnet: .NET Denial of Service Vulnerability

RHSA-2024:0255 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) dotnet: X509 Certificates - Validation Bypass across Azure dotnet: .NET Denial of Service Vulnerability

UBUNTU-CVE-2024-0057

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

WID-SEC-W-2024-0039 — Microsoft Developer Tools: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Developer Tools ausnutzen, um seine Privilegien zu erhöhen, einen Denial of Service Zustand hervorzurufen oder Sicherheitsmaßnahmen zu umgehen.