Skip to content

.NET Denial of Service Vulnerability

Critical
rbhanda published GHSA-485p-mrj5-8w2v May 10, 2022

Package

nuget Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet)

Affected versions

>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24

Patched versions

6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet)
>=6.0.0,<=6.0.4
6.0.5
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet)
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet)
>=6.0.0,<=6.0.4
6.0.5
nuget Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.win-arm (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet)
>=6.0.0,<=6.0.4
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
6.0.5
5.0.17
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet)
>=6.0.0,<=6.0.4
6.0.5
nuget Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet)
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
5.0.1
3.1.25
nuget Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet)
>=6.0.0,<=6.0.4
6.0.5
nuget Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet)
>=5.0.0,<=5.0.16
>=3.0.0,<=3.1.24
5.0.17
3.1.25

Description

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 6.0, .NET 5.0 and .NET Core 3.1 where a malicious client can cause a Denial of Service via excess memory allocations through HttpClient.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.4 or earlier.
  • Any .NET 5.0 application running .NET 5.0.16 or earlier.
  • Any .NET Core 3.1 application running on .NET Core 3.1.24 or earlier.

Affected packages

.NET 6.0 Affected packages Vulnerable versions Secure versions
Microsoft.AspNetCore.App.Runtime.win-x64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.linux-x64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.win-x86 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.osx-x64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.linux-arm64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.linux-arm >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.win-arm64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.win-arm >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.osx-arm64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >=6.0.0,<=6.0.4 6.0.5
Microsoft.AspNetCore.App.Runtime.linux-musl-arm >=6.0.0,<=6.0.4 6.0.5
.NET Core 5.0
Microsoft.AspNetCore.App.Runtime.win-x64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.linux-x64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.win-x86 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.osx-x64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.linux-arm64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.linux-arm >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.win-arm64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.win-arm >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >=5.0.0,<=5.0.16 5.0.17
Microsoft.AspNetCore.App.Runtime.linux-musl-arm >=5.0.0,<=5.0.16 5.0.17
.NET Core 3.1
Microsoft.AspNetCore.App.Runtime.win-x64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.linux-x64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.win-x86 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.osx-x64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.linux-arm64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.linux-arm >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.win-arm64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.win-arm >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >=3.0.0,<=3.1.24 3.1.25
Microsoft.AspNetCore.App.Runtime.linux-musl-arm >=3.0.0,<=3.1.24 3.1.25

Patches

.NET 6.0, .NET 5.0 and .NET Core 3.1 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Other Details

Announcement for this issue can be found at dotnet/announcements#221
An Issue for this can be found at #69149
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-23267

Severity

Critical

CVE ID

CVE-2022-23267

Weaknesses

No CWEs