Описание
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
A flaw was found in dotnet. The System.IO.Packaging library may allow untrusted inputs to influence algorithmically complex operations, resulting in a denial of service.
Отчет
.NET 6.0 (dotnet6.0) was released for RHEL 8 starting with RHEL 8.5. Therefore, this .NET version is not affected in RHEL 8.4 and previous versions. .NET 8.0 (dotnet8.0) was released for RHEL 8 starting with RHEL 8.9. Therefore, this .NET version is not affected in RHEL 8.8 and previous versions. .NET 8.0 (dotnet8.0) was released for RHEL 9 starting with RHEL 9.3. Therefore, this .NET version is not affected in RHEL 9.2 and previous versions.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | dotnet7.0 | Not affected | ||
| Red Hat Enterprise Linux 9 | dotnet9.0 | Not affected | ||
| Red Hat Enterprise Linux 8 | dotnet6.0 | Fixed | RHSA-2024:7851 | 09.10.2024 |
| Red Hat Enterprise Linux 8 | dotnet8.0 | Fixed | RHSA-2024:7868 | 09.10.2024 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | dotnet6.0 | Fixed | RHSA-2024:8082 | 14.10.2024 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | dotnet6.0 | Fixed | RHSA-2024:8082 | 14.10.2024 |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | dotnet6.0 | Fixed | RHSA-2024:8082 | 14.10.2024 |
| Red Hat Enterprise Linux 8.8 Extended Update Support | dotnet6.0 | Fixed | RHSA-2024:8036 | 14.10.2024 |
| Red Hat Enterprise Linux 9 | dotnet6.0 | Fixed | RHSA-2024:7867 | 09.10.2024 |
| Red Hat Enterprise Linux 9 | dotnet8.0 | Fixed | RHSA-2024:7869 | 09.10.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability
Уязвимость программной платформы Microsoft .NET, Microsoft .NET Framework и редактора исходного кода Visual Studio, связанная с неконтролируемым распределением памяти, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3