Ubuntu 23.10: USN-6480-1 Critical Advisory for .NET Security Issues

ubuntu

November 15, 2023

Several security issues were fixed in .NET.

Summary

Several security issues were fixed in .NET.

Software Description:

- dotnet6: dotNET CLI tools and runtime

- dotnet7: dotNET CLI tools and runtime

- dotnet8: dotNET CLI tools and runtime

Details:

Barry Dorrans discovered that .NET did not properly implement certain

security features for Blazor server forms. An attacker could possibly

use this issue to bypass validation, which could trigger unintended

actions. (CVE-2023-36558)

Piotr Bazydlo discovered that .NET did not properly handle untrusted

URIs provided to System.Net.WebRequest.Create. An attacker could possibly

use this issue to inject arbitrary commands to backend FTP servers.

(CVE-2023-36049)

Topics Covered

security advisory critical software update Ubuntu system update dotnet Blazor

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   aspnetcore-runtime-6.0          6.0.125-0ubuntu1~23.10.1
   aspnetcore-runtime-7.0          7.0.114-0ubuntu1~23.10.1
   aspnetcore-runtime-8.0          8.0.0-0ubuntu1~23.10.1
   dotnet-host                     6.0.125-0ubuntu1~23.10.1
   dotnet-host-7.0                 7.0.114-0ubuntu1~23.10.1
   dotnet-host-8.0                 8.0.0-0ubuntu1~23.10.1
   dotnet-hostfxr-6.0              6.0.125-0ubuntu1~23.10.1
   dotnet-hostfxr-7.0              7.0.114-0ubuntu1~23.10.1
   dotnet-hostfxr-8.0              8.0.0-0ubuntu1~23.10.1
   dotnet-runtime-6.0              6.0.125-0ubuntu1~23.10.1
   dotnet-runtime-7.0              7.0.114-0ubuntu1~23.10.1
   dotnet-runtime-8.0              8.0.0-0ubuntu1~23.10.1
   dotnet-sdk-6.0                  6.0.125-0ubuntu1~23.10.1
   dotnet-sdk-7.0                  7.0.114-0ubuntu1~23.10.1
   dotnet-sdk-8.0                  8.0.100-0ubuntu1~23.10.1
   dotnet6                         6.0.125-0ubuntu1~23.10.1
   dotnet7                         7.0.114-0ubuntu1~23.10.1
   dotnet8                         8.0.100-8.0.0-0ubuntu1~23.10.1

Ubuntu 23.04:
   aspnetcore-runtime-6.0          6.0.125-0ubuntu1~23.04.1
   aspnetcore-runtime-7.0          7.0.114-0ubuntu1~23.04.1
   dotnet-host                     6.0.125-0ubuntu1~23.04.1
   dotnet-host-7.0                 7.0.114-0ubuntu1~23.04.1
   dotnet-hostfxr-6.0              6.0.125-0ubuntu1~23.04.1
   dotnet-hostfxr-7.0              7.0.114-0ubuntu1~23.04.1
   dotnet-runtime-6.0              6.0.125-0ubuntu1~23.04.1
   dotnet-runtime-7.0              7.0.114-0ubuntu1~23.04.1
   dotnet-sdk-6.0                  6.0.125-0ubuntu1~23.04.1
   dotnet-sdk-7.0                  7.0.114-0ubuntu1~23.04.1
   dotnet6                         6.0.125-0ubuntu1~23.04.1
   dotnet7                         7.0.114-0ubuntu1~23.04.1

Ubuntu 22.04 LTS:
   aspnetcore-runtime-6.0          6.0.125-0ubuntu1~22.04.1
   aspnetcore-runtime-7.0          7.0.114-0ubuntu1~22.04.1
   dotnet-host                     6.0.125-0ubuntu1~22.04.1
   dotnet-host-7.0                 7.0.114-0ubuntu1~22.04.1
   dotnet-hostfxr-6.0              6.0.125-0ubuntu1~22.04.1
   dotnet-hostfxr-7.0              7.0.114-0ubuntu1~22.04.1
   dotnet-runtime-6.0              6.0.125-0ubuntu1~22.04.1
   dotnet-runtime-7.0              7.0.114-0ubuntu1~22.04.1
   dotnet-sdk-6.0                  6.0.125-0ubuntu1~22.04.1
   dotnet-sdk-7.0                  7.0.114-0ubuntu1~22.04.1
   dotnet6                         6.0.125-0ubuntu1~22.04.1
   dotnet7                         7.0.114-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.