Most recent entries from all

ALSA-2024:4438 — Moderate: dotnet6.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-6.0, AlmaLinux:8: aspnetcore-targeting-pack-6.0, AlmaLinux:8: dotnet-apphost-pack-6.0, AlmaLinux:8: dotnet-hostfxr-6.0, AlmaLinux:8: dotnet-runtime-6.0, AlmaLinux:8: dotnet-sdk-6.0, AlmaLinux:8: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-6.0, AlmaLinux:8: dotnet-templates-6.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.132 and Runtime 6.0.32.

Security Fix(es):

* dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05713

BELL-CVE-2024-38095

Affected: Alpaquita:stream: dotnet6-build, Alpaquita:stream: dotnet6-runtime

BIT-dotnet-2024-38095 — .NET and Visual Studio Denial of Service Vulnerability

Affected: Bitnami: dotnet

.NET and Visual Studio Denial of Service Vulnerability

certfr-2024-avi-0558 — De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Certaines d'entre elles permettent à un attaquant…

certfr-2024-avi-0558

CLEANSTART-2025-SC05664 — .NET and Visual Studio Denial of Service Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-38095 affects multiple packages. . See references for individual vulnerability details.

EUVD-2026-263055

fkie_cve-2024-38095

.NET and Visual Studio Denial of Service Vulnerability

GHSA-447r-wph3-92pm — Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64, NuGet: Microsoft.NetCore.App.Runtime.osx-arm64, NuGet: Microsoft.NetCore.App.Runtime.osx-x64, NuGet: Microsoft.NetCore.App.Runtime.win-arm, NuGet: Microsoft.NetCore.App.Runtime.win-arm64 and 3 more

# Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Vulnerability exists when System.Formats.Asn1 in .NET parses an X.509 certificate or collection of certificates, a malicious certificate can result in excessive CPU consumption on all platforms result in Denial of Service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/312

## <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 6.0 application running on .NET 6.0.31 or earlier. * Any .NET 8.0 application running on .NET 8.0.6 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name=".NET 6"></a>.NET 6

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >=6.0.0, <= 6.0.31 | 6.0.3…

ICSA-25-135-02 — Siemens INTRALOG WMS

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability .NET Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability .NET and Visual Studio Denial of Service Vulnerability .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability

msrc_CVE-2024-38095 — .NET and Visual Studio Denial of Service Vulnerability

msrc_CVE-2024-38095

RHSA-2024:4438 — Red Hat Security Advisory: dotnet6.0 security update

dotnet: DoS when parsing X.509 Content and ObjectIdentifiers

UBUNTU-CVE-2024-38095

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

.NET and Visual Studio Denial of Service Vulnerability

VDE-2024-067 — Phoenix Contact: Multiple Vulnerabilities in PLCnext Engineer

Vulnerabilities in .NET and Visual Studio functions System.Text.Json, System.Formats.Asn1, OPCFoundation.NetStandard.Opc.Ua.Core allow an remote attacker to execute a Denial-of-Servce attack.

WID-SEC-W-2024-1560 — Microsoft .NET Framework: Mehrere Schwachstellen

Ein lokaler oder ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Microsoft .NET Framework und Microsoft Visual Studio 2022 ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und eine Denial-of-Service-Situation zu erzeugen.