Most recent entries from all

ALSA-2024:0805 — Important: dotnet7.0 security update

Affected: AlmaLinux:9: aspnetcore-runtime-7.0, AlmaLinux:9: aspnetcore-targeting-pack-7.0, AlmaLinux:9: dotnet-apphost-pack-7.0, AlmaLinux:9: dotnet-hostfxr-7.0, AlmaLinux:9: dotnet-runtime-7.0, AlmaLinux:9: dotnet-sdk-7.0, AlmaLinux:9: dotnet-sdk-7.0-source-built-artifacts, AlmaLinux:9: dotnet-targeting-pack-7.0, AlmaLinux:9: dotnet-templates-7.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.116 and .NET Runtime 7.0.16.

Security Fix(es):

* dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-01701

BELL-CVE-2024-21386

Affected: Alpaquita:stream: dotnet6-build, Alpaquita:stream: dotnet6-runtime

certfr-2024-avi-0129 — De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un at…

certfr-2024-avi-0129

CLEANSTART-2025-QC74254 — .NET Denial of Service Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-21386 affects multiple packages. . See references for individual vulnerability details.

EUVD-2026-350736

fkie_cve-2024-21386

.NET Denial of Service Vulnerability

GHSA-g74q-5xw3-j7q9 — Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET 6.0, ASP.NET 7.0 and, ASP.NET 8.0 . This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A vulnerability exists in ASP.NET applications using SignalR where a malicious client can result in a denial-of-service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/295

### Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## Affected software

* Any .NET 6.0 application running on .NET 6.0.26 or earlier. * Any .NET 7.0 application running on .NET 7.0.15 or earlier. * Any .NET 8.0 application running on .NET 8.0.1 or earlier.

## Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### ASP.NET 6.0

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | <= 6.0.26 | 6.0.27 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | <= 6.0.26 | 6.0.27 [Microsof…

gsd-2024-21386

msrc_CVE-2024-21386 — .NET Denial of Service Vulnerability

msrc_CVE-2024-21386

RHSA-2024:0805 — Red Hat Security Advisory: dotnet7.0 security update

crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard dotnet: Denial of Service in SignalR server dotnet: Denial of Service in X509Certificate2

RHSA-2024:0814 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

dotnet: Denial of Service in SignalR server dotnet: Denial of Service in X509Certificate2

UBUNTU-CVE-2024-21386

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8

.NET Denial of Service Vulnerability

WID-SEC-W-2024-0365 — Microsoft Developer Tools: Mehrere Schwachstellen ermöglichen Codeausführung

Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Developer Tools ausnutzen, um beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.