GHSA-2m65-m22p-9wjw

Source
https://github.com/advisories/GHSA-2m65-m22p-9wjw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-2m65-m22p-9wjw/GHSA-2m65-m22p-9wjw.json
Withdrawn
2024-04-02T19:01:11Z
Published
2022-08-10T00:00:18Z
Modified
2024-04-02T19:16:23.468654Z
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vh55-786g-wjwj. This link is maintained to preserve external references.

Original Description

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.7 or earlier.
  • Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

  • If you're using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
  • If you're using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
References

Affected packages

NuGet / System.Security.Cryptography.Xml

Package

Name
System.Security.Cryptography.Xml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
4.7.1

Affected versions

4.*

4.4.0-preview1-25305-02
4.4.0-preview2-25405-01
4.4.0
4.4.1
4.4.2
4.5.0-preview1-25914-04
4.5.0-preview1-26216-02
4.5.0-preview2-26406-04
4.5.0-rc1
4.5.0
4.6.0
4.7.0

NuGet / System.Security.Cryptography.Xml

Package

Name
System.Security.Cryptography.Xml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
6.0.1

Affected versions

5.*

5.0.0

6.*

6.0.0

NuGet / Microsoft.AspNetCore.App.Runtime.win-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.win-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.win-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.win-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.linux-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.win-x86

Package

Name
Microsoft.AspNetCore.App.Runtime.win-x86

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.win-x86

Package

Name
Microsoft.AspNetCore.App.Runtime.win-x86

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.osx-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.osx-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.osx-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.osx-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm64

Package

Name
Microsoft.AspNetCore.App.Runtime.win-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm64

Package

Name
Microsoft.AspNetCore.App.Runtime.win-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm

Package

Name
Microsoft.AspNetCore.App.Runtime.win-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm

Package

Name
Microsoft.AspNetCore.App.Runtime.win-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Package

Name
Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7