Ubuntu 23.04 LTS USN-6161-1 Critical: dotnet6, dotnet7 DoS Threats

ubuntu

June 13, 2023

Several security issues were fixed in .NET.

Summary

Several security issues were fixed in .NET.

Software Description:

- dotnet6: dotNET CLI tools and runtime

- dotnet7: dotNET CLI tools and runtime

Details:

It was discovered that .NET did not properly enforce certain

restrictions when deserializing a DataSet or DataTable from

XML. An attacker could possibly use this issue to elevate their

privileges. (CVE-2023-24936)

Kevin Jones discovered that .NET did not properly handle the

AIA fetching process for X.509 client certificates. An attacker

could possibly use this issue to cause a denial of service.

(CVE-2023-29331)

Kalle Niemitalo discovered that the .NET package manager,

NuGet, was susceptible to a potential race condition. An

attacker could possibly use this issue to perform remote

code execution. (CVE-2023-29337)

Tom Deseyn discovered that .NET did not properly process certain

arguments when extracting the contents of a tar file. An attacker

could possibly use this issue to elevate their privileges...

Read the Full Advisory

Topics Covered

security advisory critical privilege escalation DoS Ubuntu dotnet6 dotnet7

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   aspnetcore-runtime-6.0          6.0.118-0ubuntu1~23.04.1
   aspnetcore-runtime-7.0          7.0.107-0ubuntu1~23.04.1
   dotnet-host                             6.0.118-0ubuntu1~23.04.1
   dotnet-host-7.0                      7.0.107-0ubuntu1~23.04.1
   dotnet-hostfxr-6.0                  6.0.118-0ubuntu1~23.04.1
   dotnet-hostfxr-7.0                  7.0.107-0ubuntu1~23.04.1
   dotnet-runtime-6.0                6.0.118-0ubuntu1~23.04.1
   dotnet-runtime-7.0                7.0.107-0ubuntu1~23.04.1
   dotnet-sdk-6.0                      6.0.118-0ubuntu1~23.04.1
   dotnet-sdk-7.0                      7.0.107-0ubuntu1~23.04.1
   dotnet6                                 6.0.118-0ubuntu1~23.04.1
   dotnet7                                 7.0.107-0ubuntu1~23.04.1

Ubuntu 22.10:
   aspnetcore-runtime-6.0          6.0.118-0ubuntu1~22.10.1
   aspnetcore-runtime-7.0          7.0.107-0ubuntu1~22.10.1
   dotnet-host                             6.0.118-0ubuntu1~22.10.1
   dotnet-host-7.0                      7.0.107-0ubuntu1~22.10.1
   dotnet-hostfxr-6.0                  6.0.118-0ubuntu1~22.10.1
   dotnet-hostfxr-7.0                  7.0.107-0ubuntu1~22.10.1
   dotnet-runtime-6.0                6.0.118-0ubuntu1~22.10.1
   dotnet-runtime-7.0                7.0.107-0ubuntu1~22.10.1
   dotnet-sdk-6.0                      6.0.118-0ubuntu1~22.10.1
   dotnet-sdk-7.0                      7.0.107-0ubuntu1~22.10.1
   dotnet6                                 6.0.118-0ubuntu1~22.10.1
   dotnet7                                 7.0.107-0ubuntu1~22.10.1

Ubuntu 22.04 LTS:
   aspnetcore-runtime-6.0          6.0.118-0ubuntu1~22.04.1
   aspnetcore-runtime-7.0          7.0.107-0ubuntu1~22.04.1
   dotnet-host                             6.0.118-0ubuntu1~22.04.1
   dotnet-host-7.0                      7.0.107-0ubuntu1~22.04.1
   dotnet-hostfxr-6.0                  6.0.118-0ubuntu1~22.04.1
   dotnet-hostfxr-7.0                  7.0.107-0ubuntu1~22.04.1
   dotnet-runtime-6.0                6.0.118-0ubuntu1~22.04.1
   dotnet-runtime-7.0                7.0.107-0ubuntu1~22.04.1
   dotnet-sdk-6.0                      6.0.118-0ubuntu1~22.04.1
   dotnet-sdk-7.0                      7.0.107-0ubuntu1~22.04.1
   dotnet6                                6.0.118-0ubuntu1~22.04.1
   dotnet7                                7.0.107-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.