CVE-2023-29337 — NuGet Client Remote Code Execution Vulnerability

Affected: Microsoft NuGet 6.2.3, Microsoft NuGet 6.4.1, Microsoft NuGet 6.5.0, Microsoft NuGet 6.3.2, Microsoft NuGet 6.0.4, Microsoft NuGet 6.6.0, Microsoft NuGet 5.11.4

NuGet Client Remote Code Execution Vulnerability

USN-6161-1 — dotnet6, dotnet7 vulnerabilities

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7

It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could possibly use this issue to elevate their privileges. (CVE-2023-24936)

Kevin Jones discovered that .NET did not properly handle the AIA fetching process for X.509 client certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-29331)

Kalle Niemitalo discovered that the .NET package manager, NuGet, was susceptible to a potential race condition. An attacker could possibly use this issue to perform remote code execution. (CVE-2023-29337)

Tom Deseyn discovered that .NET did not properly process certain arguments when extracting the contents of a tar file. An attacker could possibly use this issue to elevate their privileges. This issue only affected the dotnet7 package. (CVE-2023-32032)

It was discovered that .NET did not properly handle memory in certain circumstances. An attacker could possibly use this issue to cause a denial of service or perform remote code execution. (CVE-2023-33128)

Most recent entries from all

CVE-2023-29337 — NuGet Client Remote Code Execution Vulnerability

USN-6161-1 — dotnet6, dotnet7 vulnerabilities