Описание
.NET Core Remote Code Execution Vulnerability
A flaw was found in dotnet. When a .NET application utilizing libgdiplus on a non-Windows system accepts input, this flaw allows an attacker to send a specially crafted request that could result in remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Отчет
Red Hat Enterprise Linux 8 and the .NET versions as shipped by Red Hat are not affected by this vulnerability since libgdiplus is an optional dependency for .NET and is currently not available for Red Hat Enterprise Linux.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| .NET Core 2.1 on Red Hat Enterprise Linux | rh-dotnet21 | Not affected | ||
| .NET Core 3.1 on Red Hat Enterprise Linux | rh-dotnet31 | Not affected | ||
| .NET Core 5.0 on Red Hat Enterprise Linux | rh-dotnet50 | Not affected | ||
| Red Hat Enterprise Linux 8 | dotnet | Not affected | ||
| Red Hat Enterprise Linux 8 | dotnet3.1 | Not affected | ||
| Red Hat Enterprise Linux 8 | dotnet5.0 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Уязвимость программной платформы .NET Core, связанная недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить произвольный код
EPSS
8.1 High
CVSS3