Most recent entries from all

ALSA-2024:4450 — Important: dotnet8.0 security update

Affected: AlmaLinux:9: aspnetcore-runtime-8.0, AlmaLinux:9: aspnetcore-runtime-dbg-8.0, AlmaLinux:9: aspnetcore-targeting-pack-8.0, AlmaLinux:9: dotnet-apphost-pack-8.0, AlmaLinux:9: dotnet-host, AlmaLinux:9: dotnet-hostfxr-8.0, AlmaLinux:9: dotnet-runtime-8.0, AlmaLinux:9: dotnet-runtime-dbg-8.0, AlmaLinux:9: dotnet-sdk-8.0, AlmaLinux:9: dotnet-sdk-8.0-source-built-artifacts and 4 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.107 and Runtime 8.0.7.

Security Fix(es):

* dotnet: DoS in System.Text.Json (CVE-2024-30105) * dotnet: DoS in ASP.NET Core 8 (CVE-2024-35264) * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05254

BIT-dotnet-2024-30105 — .NET and Visual Studio Denial of Service Vulnerability

Affected: Bitnami: dotnet

.NET and Visual Studio Denial of Service Vulnerability

certfr-2024-avi-0558 — De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Certaines d'entre elles permettent à un attaquant…

certfr-2024-avi-0558

CLEANSTART-2025-GD81484 — .NET and Visual Studio Denial of Service Vulnerability

Affected: CleanStart: dotnet8-runtime

Security vulnerability affects the dotnet8-runtime package. .

cnvd-2024-37491

EUVD-2026-263056

fkie_cve-2024-30105

.NET and Visual Studio Denial of Service Vulnerability

GHSA-hh2w-p6rv-4g7w — Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability

Affected: NuGet: System.Text.Json

# Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET when calling the JsonSerializer.DeserializeAsyncEnumerable method against an untrusted input using System.Text.Json may result in Denial of Service.

## Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/104619

## <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 8.0 application running on .NET 8.0.6 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name=".NET 8"></a>.NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Text.Json](https://www.nuget.org/packages/System.Text.Json) | >= 7.0.0, < =8.0.3 | 8.0.4

## Advisory FAQ

### <a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in [aff…

gsd-2024-30105

ICSA-25-100-02 — Siemens SIDIS Prime

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions. Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm a…

msrc_CVE-2024-30105 — .NET and Visual Studio Denial of Service Vulnerability

msrc_CVE-2024-30105

RHSA-2024:4450 — Red Hat Security Advisory: dotnet8.0 security update

dotnet: DoS in System.Text.Json dotnet: DoS in ASP.NET Core 8 dotnet: DoS when parsing X.509 Content and ObjectIdentifiers

UBUNTU-CVE-2024-30105

Affected: Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

.NET and Visual Studio Denial of Service Vulnerability

VDE-2024-067 — Phoenix Contact: Multiple Vulnerabilities in PLCnext Engineer

Vulnerabilities in .NET and Visual Studio functions System.Text.Json, System.Formats.Asn1, OPCFoundation.NetStandard.Opc.Ua.Core allow an remote attacker to execute a Denial-of-Servce attack.

WID-SEC-W-2024-1560 — Microsoft .NET Framework: Mehrere Schwachstellen

Ein lokaler oder ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Microsoft .NET Framework und Microsoft Visual Studio 2022 ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und eine Denial-of-Service-Situation zu erzeugen.