Alerts This Week
Warning Icon 1 646
Alerts This Week
Warning Icon 1 646

Ubuntu 23.04 & 22.04 LTS USN-6427-1 Critical: .NET Denial Of Service

Calendar Oct 10, 2023 • User Avatar LinuxSecurity Advisories
2 - 3 min read
Ubuntu Large Esm H500
Topics%20covered

Topics Covered

security advisory denial of service critical threat network traffic ubuntu dotnet
.NET could be made to crash if it received specially crafted network traffic. 
==========================================================================
Ubuntu Security Notice USN-6427-1
October 10, 2023

dotnet6, dotnet7 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS

Summary:

.NET could be made to crash if it received specially crafted network
traffic.

Software Description:
- dotnet6: dotNET CLI tools and runtime
- dotnet7: dotNET CLI tools and runtime

Details:

It was discovered that the .NET Kestrel web server did not properly handle
HTTP/2 requests. A remote attacker could possibly use this issue to cause a
denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   aspnetcore-runtime-6.0           6.0.123-0ubuntu1~23.04.1
   aspnetcore-runtime-7.0           7.0.112-0ubuntu1~23.04.1
   dotnet-host 6.0.123-0ubuntu1~23.04.1
   dotnet-host-7.0                        7.0.112-0ubuntu1~23.04.1
   dotnet-hostfxr-6.0                    6.0.123-0ubuntu1~23.04.1
   dotnet-hostfxr-7.0                    7.0.112-0ubuntu1~23.04.1
   dotnet-runtime-6.0                   6.0.123-0ubuntu1~23.04.1
   dotnet-runtime-7.0                   7.0.112-0ubuntu1~23.04.1
   dotnet-sdk-6.0                         6.0.123-0ubuntu1~23.04.1
   dotnet-sdk-7.0                         7.0.112-0ubuntu1~23.04.1
   dotnet6 6.0.123-0ubuntu1~23.04.1
   dotnet7 7.0.112-0ubuntu1~23.04.1

Ubuntu 22.04 LTS:
   aspnetcore-runtime-6.0           6.0.123-0ubuntu1~22.04.1
   aspnetcore-runtime-7.0           7.0.112-0ubuntu1~22.04.1
   dotnet-host 6.0.123-0ubuntu1~22.04.1
   dotnet-host-7.0                        7.0.112-0ubuntu1~22.04.1
   dotnet-hostfxr-6.0                    6.0.123-0ubuntu1~22.04.1
   dotnet-hostfxr-7.0                    7.0.112-0ubuntu1~22.04.1
   dotnet-runtime-6.0                   6.0.123-0ubuntu1~22.04.1
   dotnet-runtime-7.0                   7.0.112-0ubuntu1~22.04.1
   dotnet-sdk-6.0                         6.0.123-0ubuntu1~22.04.1
   dotnet-sdk-7.0                         7.0.112-0ubuntu1~22.04.1
   dotnet6 6.0.123-0ubuntu1~22.04.1
   dotnet7 7.0.112-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6427-1
   CVE-2023-44487

Package Information:
https://launchpad.net/ubuntu/+source/dotnet6/6.0.123-0ubuntu1~23.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.112-0ubuntu1~23.04.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.123-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.112-0ubuntu1~22.04.1

Ubuntu 23.04 & 22.04 LTS USN-6427-1 Critical: .NET Denial Of Service

ubuntu
Calendar Grey October 10, 2023
Dist Ubuntu Esm H88
Urgent security notice for Ubuntu users regarding vulnerabilities in .NET's network traffic processing, which could lead to system failures. Immediate update is advised.
.NET could be made to crash if it received specially crafted network traffic.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS Summary: .NET could be made to crash if it received specially crafted network traffic. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime Details: It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service.

Topics%20covered

Topics Covered

security advisory denial of service critical threat network traffic ubuntu dotnet

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04:   aspnetcore-runtime-6.0           6.0.123-0ubuntu1~23.04.1   aspnetcore-runtime-7.0           7.0.112-0ubuntu1~23.04.1   dotnet-host 6.0.123-0ubuntu1~23.04.1   dotnet-host-7.0                        7.0.112-0ubuntu1~23.04.1   dotnet-hostfxr-6.0                    6.0.123-0ubuntu1~23.04.1   dotnet-hostfxr-7.0                    7.0.112-0ubuntu1~23.04.1   dotnet-runtime-6.0                   6.0.123-0ubuntu1~23.04.1   dotnet-runtime-7.0                   7.0.112-0ubuntu1~23.04.1   dotnet-sdk-6.0                         6.0.123-0ubuntu1~23.04.1   dotnet-sdk-7.0                         7.0.112-0ubuntu1~23.04.1   dotnet6 6.0.123-0ubuntu1~23.04.1   dotnet7 7.0.112-0ubuntu1~23.04.1 Ubuntu 22.04 LTS:   aspnetcore-runtime-6.0           6.0.123-0ubuntu1~22.04.1   aspnetcore-runtime-7.0           7.0.112-0ubuntu1~22.04.1   dotnet-host 6.0.123-0ubuntu1~22.04.1   dotnet-host-7.0                        7.0.112-0ubuntu1~22.04.1   dotnet-hostfxr-6.0                    6.0.123-0ubuntu1~22.04.1   dotnet-hostfxr-7.0                    7.0.112-0ubuntu1~22.04.1   dotnet-runtime-6.0                   6.0.123-0ubuntu1~22.04.1   dotnet-runtime-7.0                   7.0.112-0ubuntu1~22.04.1   dotnet-sdk-6.0                         6.0.123-0ubuntu1~22.04.1   dotnet-sdk-7.0                         7.0.112-0ubuntu1~22.04.1   dotnet6 6.0.123-0ubuntu1~22.04.1   dotnet7 7.0.112-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6427-1

  CVE-2023-44487

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6427-1

Topics%20covered

Topics Covered

security advisory denial of service critical threat network traffic ubuntu dotnet

Package Information

https://launchpad.net/ubuntu/+source/dotnet6/6.0.123-0ubuntu1~23.04.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.112-0ubuntu1~23.04.1 https://launchpad.net/ubuntu/+source/dotnet6/6.0.123-0ubuntu1~22.04.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.112-0ubuntu1~22.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here