USN-6578-1

See a problem?
Source
https://ubuntu.com/security/notices/USN-6578-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-6578-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-6578-1
Related
Published
2024-01-11T15:44:28.779839Z
Modified
2024-01-11T15:44:28.779839Z
Summary
dotnet6, dotnet7, dotnet8 vulnerabilities
Details

Vishal Mishra and Anita Gaud discovered that .NET did not properly validate X.509 certificates with malformed signatures. An attacker could possibly use this issue to bypass an application's typical authentication logic. (CVE-2024-0057)

Morgan Brown discovered that .NET did not properly handle requests from unauthenticated clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21319)

References

Affected packages

Ubuntu:22.04:LTS / dotnet6

Package

Name
dotnet6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.126-0ubuntu1~22.04.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "dotnet-host": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-templates-6.0": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-hostfxr-6.0": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-apphost-pack-6.0": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-sdk-6.0": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-sdk-6.0-source-built-artifacts": "6.0.126-0ubuntu1~22.04.1",
            "aspnetcore-runtime-6.0": "6.0.126-0ubuntu1~22.04.1",
            "netstandard-targeting-pack-2.1": "6.0.126-0ubuntu1~22.04.1",
            "dotnet6": "6.0.126-0ubuntu1~22.04.1",
            "aspnetcore-targeting-pack-6.0": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-runtime-6.0": "6.0.126-0ubuntu1~22.04.1",
            "dotnet-targeting-pack-6.0": "6.0.126-0ubuntu1~22.04.1"
        }
    ]
}

Ubuntu:22.04:LTS / dotnet7

Package

Name
dotnet7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.115-0ubuntu1~22.04.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "netstandard-targeting-pack-2.1-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-sdk-7.0": "7.0.115-0ubuntu1~22.04.1",
            "aspnetcore-runtime-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet7": "7.0.115-0ubuntu1~22.04.1",
            "aspnetcore-targeting-pack-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-apphost-pack-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-runtime-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-hostfxr-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-host-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-sdk-7.0-source-built-artifacts": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-targeting-pack-7.0": "7.0.115-0ubuntu1~22.04.1",
            "dotnet-templates-7.0": "7.0.115-0ubuntu1~22.04.1"
        }
    ]
}

Ubuntu:23.10 / dotnet6

Package

Name
dotnet6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.126-0ubuntu1~23.10.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "dotnet-host": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-templates-6.0": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-hostfxr-6.0": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-apphost-pack-6.0": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-sdk-6.0": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-sdk-6.0-source-built-artifacts": "6.0.126-0ubuntu1~23.10.1",
            "aspnetcore-runtime-6.0": "6.0.126-0ubuntu1~23.10.1",
            "netstandard-targeting-pack-2.1": "6.0.126-0ubuntu1~23.10.1",
            "dotnet6": "6.0.126-0ubuntu1~23.10.1",
            "aspnetcore-targeting-pack-6.0": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-runtime-6.0": "6.0.126-0ubuntu1~23.10.1",
            "dotnet-targeting-pack-6.0": "6.0.126-0ubuntu1~23.10.1"
        }
    ]
}

Ubuntu:23.10 / dotnet7

Package

Name
dotnet7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.115-0ubuntu1~23.10.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "netstandard-targeting-pack-2.1-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-sdk-7.0": "7.0.115-0ubuntu1~23.10.1",
            "aspnetcore-runtime-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet7": "7.0.115-0ubuntu1~23.10.1",
            "aspnetcore-targeting-pack-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-apphost-pack-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-runtime-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-hostfxr-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-host-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-sdk-7.0-source-built-artifacts": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-targeting-pack-7.0": "7.0.115-0ubuntu1~23.10.1",
            "dotnet-templates-7.0": "7.0.115-0ubuntu1~23.10.1"
        }
    ]
}

Ubuntu:23.10 / dotnet8

Package

Name
dotnet8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.0.101-8.0.1-0ubuntu1~23.10.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "dotnet-host-8.0": "8.0.1-0ubuntu1~23.10.1",
            "dotnet-templates-8.0": "8.0.101-0ubuntu1~23.10.1",
            "dotnet8": "8.0.101-8.0.1-0ubuntu1~23.10.1",
            "netstandard-targeting-pack-2.1-8.0": "8.0.101-0ubuntu1~23.10.1",
            "dotnet-apphost-pack-8.0": "8.0.1-0ubuntu1~23.10.1",
            "dotnet-sdk-8.0-source-built-artifacts": "8.0.101-0ubuntu1~23.10.1",
            "dotnet-hostfxr-8.0": "8.0.1-0ubuntu1~23.10.1",
            "aspnetcore-runtime-8.0": "8.0.1-0ubuntu1~23.10.1",
            "aspnetcore-targeting-pack-8.0": "8.0.1-0ubuntu1~23.10.1",
            "dotnet-runtime-8.0": "8.0.1-0ubuntu1~23.10.1",
            "dotnet-targeting-pack-8.0": "8.0.1-0ubuntu1~23.10.1",
            "dotnet-sdk-8.0": "8.0.101-0ubuntu1~23.10.1"
        }
    ]
}