Описание
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Отчет
An IMPORTANT severity security feature bypass vulnerability was found in the .NET (dotnet10.0) packages shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and Red Hat Hardened Images. Improper verification of cryptographic signatures in .NET allows an unauthorized remote attacker, in a scenario requiring user interaction, to bypass a security feature: signature verification for .NET file-based apps can fail to enforce the expected trust decision, with potential impact on the confidentiality, integrity, and availability of the application's trust decisions. A fix for the affected Red Hat products is being pursued through the upstream .NET releases, to which resolution of this flaw is delegated. The dotnet8.0 component in Red Hat Hardened Images is not affected by this issue. Red Hat's severity rating of IMPORTANT (CVSS 3.1 score 8.8) is consistent with the upstream Microsoft assessment.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | dotnet8.0 | Not affected | ||
| Red Hat Enterprise Linux 10 | dotnet10.0 | Fixed | RHSA-2026:86195 | 20.10.2026 |
| Red Hat Enterprise Linux 8 | dotnet10.0 | Fixed | RHSA-2026:86192 | 20.10.2026 |
| Red Hat Enterprise Linux 9 | dotnet10.0 | Fixed | RHSA-2026:86193 | 20.10.2026 |
| Red Hat Hardened Images | dotnet10-0-main-10.0.113-1.hum1 | Fixed | RHSA-2026:84491 | 18.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
EPSS
8.8 High
CVSS3