GHSA-2m65-m22p-9wjw

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-2m65-m22p-9wjw/GHSA-2m65-m22p-9wjw.json
Aliases
  • CVE-2022-34716
Published
2022-08-10T00:00:18Z
Modified
2022-09-22T04:02:12.148308Z
Details

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.7 or earlier.
  • Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

  • If you're using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
  • If you're using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
References

Affected packages

NuGet / System.Security.Cryptography.Xml

System.Security.Cryptography.Xml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
4.7.1

Affected versions

4.*

4.4.0
4.4.0-preview1-25305-02
4.4.0-preview2-25405-01
4.4.1
4.4.2
4.5.0
4.5.0-preview1-25914-04
4.5.0-preview1-26216-02
4.5.0-preview2-26406-04
4.5.0-rc1
4.6.0
4.7.0

NuGet / System.Security.Cryptography.Xml

System.Security.Cryptography.Xml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
6.0.1

Affected versions

5.*

5.0.0

6.*

6.0.0

NuGet / Microsoft.AspNetCore.App.Runtime.win-x64

Microsoft.AspNetCore.App.Runtime.win-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.win-x64

Microsoft.AspNetCore.App.Runtime.win-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-x64

Microsoft.AspNetCore.App.Runtime.linux-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.linux-x64

Microsoft.AspNetCore.App.Runtime.linux-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.win-x86

Microsoft.AspNetCore.App.Runtime.win-x86

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.win-x86

Microsoft.AspNetCore.App.Runtime.win-x86

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.osx-x64

Microsoft.AspNetCore.App.Runtime.osx-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.osx-x64

Microsoft.AspNetCore.App.Runtime.osx-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Microsoft.AspNetCore.App.Runtime.linux-musl-x64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm64

Microsoft.AspNetCore.App.Runtime.linux-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm64

Microsoft.AspNetCore.App.Runtime.linux-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm

Microsoft.AspNetCore.App.Runtime.linux-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.linux-arm

Microsoft.AspNetCore.App.Runtime.linux-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm64

Microsoft.AspNetCore.App.Runtime.win-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm64

Microsoft.AspNetCore.App.Runtime.win-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm

Microsoft.AspNetCore.App.Runtime.win-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.win-arm

Microsoft.AspNetCore.App.Runtime.win-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

3.*

3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.28

Affected versions

NuGet / Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Microsoft.AspNetCore.App.Runtime.linux-musl-arm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.8

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7