Linux · Security advisory · November 28, 2023

RLSA-2023:7256: dotnet7.0 security update

RLSA-2023:7256, released November 28, 2023, fixes 2 CVEs in dotnet7.0 (version 0:7.0.114-1.el8_9). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0679

94th percentile

Priority of the 2 CVEs

Patch now 0
                                Urgent 0
                                High 1
                                Routine 1

Fixed package versions

Product	Release	Fixed in
dotnet7.0	rocky 8	0:7.0.114-1.el8_9

CVEs this fix closes

Priority	CVE	Title	Impact	CVSS	EPSS	Exploitation
High	CVE-2023-36049	.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability		9.8	0.0679	Exploitation Less Likely
Routine	CVE-2023-36558	ASP.NET Core Security Feature Bypass Vulnerability		6.5	0.0108	Exploitation Less Likely

Also fixes CVE-2023-36049

KB5032197
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 and 9 more
KB5032199
Microsoft .NET Framework 3.5 AND 4.6/4.6.2 on Windows 10 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6/4.6.2 on Windows 10 for x64-based Systems, Microsoft Defender for Endpoint for Windows on Windows 10 for 32-bit Systems and 3 more
KB5032883
.NET 6.0
KB5032884
.NET 7.0
ALAS2023-2023-457
aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet and 16 more on amzn 2023
RLSA-2023:7258
dotnet6.0 on rocky 8
ELSA-2023-7253
aspnetcore-runtime-8.0, aspnetcore-targeting-pack-8.0, dotnet-apphost-pack-8.0 and 6 more on ol 9
ELSA-2023-7255
aspnetcore-runtime-7.0, aspnetcore-targeting-pack-7.0, dotnet-apphost-pack-7.0 and 8 more on ol 9

Vendor advisory

https://errata.rockylinux.org/RLSA-2023:7256

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo