Описание
Duplicate Advisory: .NET Information Disclosure Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vh55-786g-wjwj. This link is maintained to preserve external references.
Original Description
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.
Affected software
- Any .NET 6.0 application running on .NET 6.0.7 or earlier.
- Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.
Patches
- If you're using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
- If you're using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
Ссылки
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-vh55-786g-wjwj
- https://nvd.nist.gov/vuln/detail/CVE-2022-34716
- https://github.com/dotnet/announcements/issues/232
- https://github.com/dotnet/aspnetcore/issues/43166
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34716
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-34716
Пакеты
System.Security.Cryptography.Xml
< 4.7.1
4.7.1
System.Security.Cryptography.Xml
>= 5.0.0, < 6.0.1
6.0.1
Microsoft.AspNetCore.App.Runtime.win-x64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.win-x64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.linux-x64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.linux-x64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.win-x86
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.win-x86
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.osx-x64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.osx-x64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.linux-musl-x64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.linux-musl-x64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.linux-arm64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.linux-arm64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.linux-arm
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.linux-arm
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.win-arm64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.win-arm64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.win-arm
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.win-arm
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64
>= 6.0.0, < 6.0.8
6.0.8
Microsoft.AspNetCore.App.Runtime.linux-musl-arm
>= 3.1.0, < 3.1.28
3.1.28
Microsoft.AspNetCore.App.Runtime.linux-musl-arm
>= 6.0.0, < 6.0.8
6.0.8
5.9 Medium
CVSS3
5.9 Medium
CVSS3