Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

RHEL: RHSA-2017-3248-01 Low Severity: .NET Core Denial Of Service

red hat
Calendar Grey November 20, 2017
Scroller Redhat
A security patch has been released for .NET Core on RHEL, classified as Low severity, addressing various security concerns and remedies.
A security update for .NET Core on RHEL is now available

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

New versions of .NET Core that address several security vulnerabilities are now available. The updated versions are .NET Core 1.0.8, 1.1.5 and 2.0.3.
Security Fixes:
* By providing an invalid culture, an attacker can cause a recursive lookup that leads to a denial of service. (CVE-2017-8585)
* Supplying a specially crafted certificate can cause an infinite X509Chain, resulting in a denial of service. (CVE-2017-11770)

Topics%20covered

Topics Covered

security advisory denial of service security update software update low severity RHEL dotnet

References

https://access.redhat.com/security/cve/CVE-2017-8585 https://access.redhat.com/security/cve/CVE-2017-11770 https://access.redhat.com/security/updates/classification/#low https://github.com/dotnet/announcements/issues/34 https://github.com/dotnet/announcements/issues/44 https://github.com/dotnet/core/blob/main/release-notes/2.0/2.0.3.md https://github.com/dotnet/core/blob/main/release-notes/1.1/1.1.5.md https://github.com/dotnet/core/blob/main/release-notes/1.0/1.0.8.md

Package List

dotNET on RHEL for Red Hat Enterprise Linux ComputeNode (v. 7):
Source: rh-dotnetcore10-dotnetcore-1.0.8-1.el7.src.rpm
x86_64: rh-dotnetcore10-dotnetcore-1.0.8-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.8-1.el7.x86_64.rpm
dotNET on RHEL for Red Hat Enterprise Linux ComputeNode (v. 7):
Source: rh-dotnetcore11-dotnetcore-1.1.5-1.el7.src.rpm
x86_64: rh-dotnetcore11-dotnetcore-1.1.5-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.5-1.el7.x86_64.rpm
dotNET on RHEL for Red Hat Enterprise Linux ComputeNode (v. 7):
Source: rh-dotnet20-dotnet-2.0.3-4.el7.src.rpm
x86_64: rh-dotnet20-dotnet-2.0.3-4.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.3-4.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.3-4.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.3-4.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.0-2.0.3-4.el7.x86_64.rpm
dotNET on RHEL for Red Hat Enterprise Linux Server (v. 7):
Source: rh-dotnetcore10-dotnetcore-1.0.8-1.el7.src.rpm
x86_64: rh-dotnetcore10-dotnetcore-1.0.8-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.8-1.el7.x86_64.rpm
dotNET on RHEL for Red Hat Enterprise Linux Server (v. 7):
Source: rh-dotnetcore11-dotnetcore-1.1.5-1.el7.src.rpm
x86_64: rh-dotnetcore11-dotnetcore-1.1.5-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.5-1.el7.x86_64.rpm


Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2017:3248-01
Product: dotNET on RHEL
Advisory URL: https://access.redhat.com/errata/RHSA-2017:3248
Issue date: 2017-11-20

Topic

A security update for .NET Core on RHEL is now available.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory denial of service security update software update low severity RHEL dotnet

Relevant Releases Architectures

dotNET on RHEL for Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

dotNET on RHEL for Red Hat Enterprise Linux Server (v. 7) - x86_64

dotNET on RHEL for Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Bugs Fixed

1512982 - CVE-2017-8585 dotNet: DDoS via invalid culture

1512992 - CVE-2017-11770 dotNET: DDos via bad certificate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.