Lucene search
Copyright (C) 2024 Greenbone AGOPENVAS:136141256231112202465781HistoryJan 12, 2024 - 12:00 a.m.
Ubuntu: Security Advisory (USN-6578-1)
2024-01-1200:00:00
Copyright (C) 2024 Greenbone AG
plugins.openvas.org
1
ubuntu
security advisory
dotnet6
dotnet7
dotnet8
cve-2024-0057
cve-2024-21319
authentication bypass
denial of service
package update
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
49.7%
The remote host is missing an update for the
# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.1.12.2024.6578.1");
script_cve_id("CVE-2024-0057", "CVE-2024-21319");
script_tag(name:"creation_date", value:"2024-01-12 04:09:10 +0000 (Fri, 12 Jan 2024)");
script_version("2024-02-02T05:06:10+0000");
script_tag(name:"last_modification", value:"2024-02-02 05:06:10 +0000 (Fri, 02 Feb 2024)");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2024-01-16 18:47:36 +0000 (Tue, 16 Jan 2024)");
script_name("Ubuntu: Security Advisory (USN-6578-1)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2024 Greenbone AG");
script_family("Ubuntu Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/ubuntu_linux", "ssh/login/packages", re:"ssh/login/release=UBUNTU(22\.04\ LTS|23\.04|23\.10)");
script_xref(name:"Advisory-ID", value:"USN-6578-1");
script_xref(name:"URL", value:"https://ubuntu.com/security/notices/USN-6578-1");
script_tag(name:"summary", value:"The remote host is missing an update for the 'dotnet6, dotnet7, dotnet8' package(s) announced via the USN-6578-1 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"Vishal Mishra and Anita Gaud discovered that .NET did not properly
validate X.509 certificates with malformed signatures. An attacker
could possibly use this issue to bypass an application's typical
authentication logic.
(CVE-2024-0057)
Morgan Brown discovered that .NET did not properly handle requests from
unauthenticated clients. An attacker could possibly use this issue to
cause a denial of service.
(CVE-2024-21319)");
script_tag(name:"affected", value:"'dotnet6, dotnet7, dotnet8' package(s) on Ubuntu 22.04, Ubuntu 23.04, Ubuntu 23.10.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-deb.inc");
release = dpkg_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "UBUNTU22.04 LTS") {
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-6.0", ver:"6.0.126-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-7.0", ver:"7.0.115-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host", ver:"6.0.126-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host-7.0", ver:"7.0.115-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-6.0", ver:"6.0.126-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-7.0", ver:"7.0.115-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-6.0", ver:"6.0.126-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-7.0", ver:"7.0.115-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-6.0", ver:"6.0.126-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-7.0", ver:"7.0.115-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet6", ver:"6.0.126-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet7", ver:"7.0.115-0ubuntu1~22.04.1", rls:"UBUNTU22.04 LTS"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "UBUNTU23.04") {
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-6.0", ver:"6.0.126-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-7.0", ver:"7.0.115-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host", ver:"6.0.126-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host-7.0", ver:"7.0.115-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-6.0", ver:"6.0.126-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-7.0", ver:"7.0.115-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-6.0", ver:"6.0.126-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-7.0", ver:"7.0.115-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-6.0", ver:"6.0.126-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-7.0", ver:"7.0.115-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet6", ver:"6.0.126-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet7", ver:"7.0.115-0ubuntu1~23.04.1", rls:"UBUNTU23.04"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "UBUNTU23.10") {
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-6.0", ver:"6.0.126-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-7.0", ver:"7.0.115-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"aspnetcore-runtime-8.0", ver:"8.0.1-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host", ver:"6.0.126-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host-7.0", ver:"7.0.115-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-host-8.0", ver:"8.0.1-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-6.0", ver:"6.0.126-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-7.0", ver:"7.0.115-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-hostfxr-8.0", ver:"8.0.1-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-6.0", ver:"6.0.126-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-7.0", ver:"7.0.115-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-runtime-8.0", ver:"8.0.1-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-6.0", ver:"6.0.126-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-7.0", ver:"7.0.115-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet-sdk-8.0", ver:"8.0.101-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet6", ver:"6.0.126-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet7", ver:"7.0.115-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"dotnet8", ver:"8.0.101-8.0.1-0ubuntu1~23.10.1", rls:"UBUNTU23.10"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Related
ubuntu
ubuntu
.NET vulnerabilities
2024-01-11 00:00:00
nessus
nessus
Ubuntu 22.04 LTS / 23.04 / 23.10 : .NET vulnerabilities (USN-6578-1)
2024-01-11 00:00:00
CentOS 8 : .NET 8.0 (CESA-2024:0150)
2024-01-30 00:00:00
CentOS 8 : .NET 6.0 (CESA-2024:0158)
2024-01-22 00:00:00
osv
osv
dotnet6, dotnet7, dotnet8 vulnerabilities
2024-01-11 15:44:28
Important: .NET 7.0 security update
2024-01-12 19:57:42
Important: .NET 6.0 security update
2024-01-10 00:00:00
oraclelinux
oraclelinux
.NET 7.0 security update
2024-01-17 00:00:00
.NET 6.0 security update
2024-01-12 00:00:00
.NET 8.0 security update
2024-02-20 00:00:00
almalinux
almalinux
Important: .NET 6.0 security update
2024-01-10 00:00:00
Important: .NET 8.0 security update
2024-01-10 00:00:00
Important: .NET 7.0 security update
2024-01-10 00:00:00
redhat
redhat
(RHSA-2024:0152) Important: .NET 8.0 security update
2024-01-10 15:18:52
(RHSA-2024:0150) Important: .NET 8.0 security update
2024-01-10 15:15:53
openvas
openvas
.NET Core Multiple Vulnerabilities (KB5033741)
2024-01-11 00:00:00
.NET Core Multiple Vulnerabilities (KB5033733)
2024-01-11 00:00:00
.NET Core Multiple Vulnerabilities (KB5033734)
2024-01-11 00:00:00
rocky
rocky
.NET 8.0 security update
2024-01-12 19:57:42
.NET 6.0 security update
2024-01-12 19:57:42
.NET 7.0 security update
2024-01-12 19:57:42
mskb
mskb
.NET 8.0 Update - January 09, 2024 (KB5033741)
2024-01-09 08:00:00
.NET 6.0 Update - January 09, 2024 (KB5033733)
2024-01-09 08:00:00
.NET 7.0 Update - January 09, 2024 (KB5033734)
2024-01-09 08:00:00
cve
cve
prion
prion
Denial of service
2024-01-09 19:15:00
Security feature bypass
2024-01-09 18:15:00
veracode
veracode
Denial Of Service (DoS)
2024-01-10 10:01:02
Protection Mechanism Failure
2024-01-30 18:59:03
github
github
Microsoft ASP.NET Core project templates vulnerable to denial of service
2024-01-09 19:35:02
NuGet Client Security Feature Bypass Vulnerability
2024-02-13 21:18:10
JWX vulnerable to a denial of service attack using compressed JWE message
2024-03-08 15:06:53
alpinelinux
alpinelinux
CVE-2024-21319
2024-01-09 19:15:12
CVE-2024-0057
2024-01-09 18:15:46
mscve
mscve
Microsoft Identity Denial of service vulnerability
2024-01-09 08:00:00
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
2024-01-09 08:00:00
ubuntucve
ubuntucve
redhatcve
redhatcve
wolfi
wolfi
CVE-2024-0057 vulnerabilities
2024-05-13 09:06:53
redos
redos
ROS-20240418-02
2024-04-18 00:00:00
cgr
cgr
CVE-2024-0057 vulnerabilities
2024-05-13 09:06:52
kaspersky
kaspersky
KLA62822 Multiple vulnerabilities in Microsoft Developer Tools
2024-01-09 00:00:00
KLA62826 Multiple vulnerabilities in Microsoft Azure
2024-01-09 00:00:00
debiancve
debiancve
CVE-2024-33664
2024-04-26 00:15:09
photon
photon
Critical Photon OS Security Update - PHSA-2024-3.0-0717
2024-01-25 00:00:00
Critical Photon OS Security Update - PHSA-2024-5.0-0195
2024-01-25 00:00:00
Critical Photon OS Security Update - PHSA-2024-4.0-0556
2024-01-25 00:00:00
rapid7blog
rapid7blog
Patch Tuesday - January 2024
2024-01-09 21:23:10
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
49.7%
Related for OPENVAS:136141256231112202465781