Описание
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
A flaw was found in dotnet. The System.Security.Cryptography.Cose, System.IO.Packaging and System.Runtime.Caching components may be exposed to hostile input, making them susceptible to hash flooding attacks, resulting in denial of service.
Отчет
.NET 6.0 (dotnet6.0) was released for RHEL 8 starting with RHEL 8.5. Therefore, this .NET version is not affected in RHEL 8.4 and previous versions. .NET 8.0 (dotnet8.0) was released for RHEL 8 starting with RHEL 8.9. Therefore, this .NET version is not affected in RHEL 8.8 and previous versions. .NET 8.0 (dotnet8.0) was released for RHEL 9 starting with RHEL 9.3. Therefore, this .NET version is not affected in RHEL 9.2 and previous versions.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | dotnet8.0 | Affected | ||
| Red Hat Enterprise Linux 10 | dotnet9.0 | Not affected | ||
| Red Hat Enterprise Linux 9 | dotnet7.0 | Not affected | ||
| Red Hat Enterprise Linux 9 | dotnet9.0 | Not affected | ||
| Red Hat Enterprise Linux 8 | dotnet6.0 | Fixed | RHSA-2024:7851 | 09.10.2024 |
| Red Hat Enterprise Linux 8 | dotnet8.0 | Fixed | RHSA-2024:7868 | 09.10.2024 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | dotnet6.0 | Fixed | RHSA-2024:8082 | 14.10.2024 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | dotnet6.0 | Fixed | RHSA-2024:8082 | 14.10.2024 |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | dotnet6.0 | Fixed | RHSA-2024:8082 | 14.10.2024 |
| Red Hat Enterprise Linux 8.8 Extended Update Support | dotnet6.0 | Fixed | RHSA-2024:8036 | 14.10.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability
Уязвимость программной платформы Microsoft .NET, Microsoft .NET Framework и редактора исходного кода Visual Studio, связанная с алгоритмической сложностью, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3