.NET vulnerabilities

2024-02-1300:00:00

ubuntu.com

ubuntu

.net

signalr

openssl

denial of service

cve-2024-21386

cve-2024-21404

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.3%

JSON

Releases

Ubuntu 23.10
Ubuntu 22.04 LTS

Packages

dotnet6 - dotNET CLI tools and runtime
dotnet7 - dotNET CLI tools and runtime
dotnet8 - dotNET CLI tools and runtime

Details

Brennan Conroy discovered that .NET with SignalR did not properly
handle malicious clients. An attacker could possibly use this issue
to cause a denial of service. (CVE-2024-21386)

Bahaa Naamneh discovered that .NET with OpenSSL support did not
properly parse X509 certificates. An attacker could possibly use
this issue to cause a denial of service. (CVE-2024-21404)

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchaspnetcore-runtime-6.0< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchaspnetcore-targeting-pack-6.0< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-apphost-pack-6.0< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-apphost-pack-6.0-dbgsym< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-host< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-host-dbgsym< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-hostfxr-6.0< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-hostfxr-6.0-dbgsym< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-runtime-6.0< 6.0.127-0ubuntu1~23.10.1UNKNOWN
Ubuntu23.10noarchdotnet-runtime-6.0-dbgsym< 6.0.127-0ubuntu1~23.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	23.10	noarch	aspnetcore-runtime-6.0	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	aspnetcore-targeting-pack-6.0	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-apphost-pack-6.0	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-apphost-pack-6.0-dbgsym	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-host	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-host-dbgsym	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-hostfxr-6.0	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-hostfxr-6.0-dbgsym	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-runtime-6.0	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN
Ubuntu	23.10	noarch	dotnet-runtime-6.0-dbgsym	< 6.0.127-0ubuntu1~23.10.1	UNKNOWN