Vulnerability-Lookup

CVE-2023-36799 (GCVE-0-2023-36799)

Vulnerability from cvelistv5 – Published: 2023-09-12 16:58 – Updated: 2025-10-30 18:18

Title

.NET Core and Visual Studio Denial of Service Vulnerability

Summary

.NET Core and Visual Studio Denial of Service Vulnerability

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-29 16:23 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

microsoft mitre root

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

8 products

Vendor	Product	Version	CPE status
Microsoft	.NET 6.0	Affected: 6.0.0 , < 6.0.24 (custom)	guessed
Microsoft	.NET 7.0	Affected: 7.0.0 , < 7.0.13 (custom)	guessed
Microsoft	Microsoft Visual Studio 2022 version 17.2	Affected: 17.2.0 , < 17.2.21 (custom)	guessed
Microsoft	Microsoft Visual Studio 2022 version 17.4	Affected: 17.4.0 , < 17.4.13 (custom)	guessed
Microsoft	Microsoft Visual Studio 2022 version 17.7	Affected: 17.7.0 , < 17.6.9 (custom)	guessed
Microsoft	Microsoft Visual Studio 2022 version 17.6	Affected: 17.6.0 , < 17.6.9 (custom)	guessed
Microsoft	PowerShell 7.2	Affected: 7.2.0 , < 7.2.14 (custom)	guessed
Microsoft	PowerShell 7.3	Affected: 7.3.0 , < 7.2.14 (custom)	guessed

Date Public

2023-09-12 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36799",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T16:23:47.132893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:25:46.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.676Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": ".NET Core and Visual Studio Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 6.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.24",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": ".NET 7.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.13",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.2.21",
              "status": "affected",
              "version": "17.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.4",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.4.13",
              "status": "affected",
              "version": "17.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.6.9",
              "status": "affected",
              "version": "17.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Visual Studio 2022 version 17.6",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.6.9",
              "status": "affected",
              "version": "17.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "PowerShell 7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.2.14",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "PowerShell 7.3",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.2.14",
              "status": "affected",
              "version": "7.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.24",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.2.21",
                  "versionStartIncluding": "17.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.4.13",
                  "versionStartIncluding": "17.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.6.9",
                  "versionStartIncluding": "17.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.6.9",
                  "versionStartIncluding": "17.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.14",
                  "versionStartIncluding": "7.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:powershell:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.14",
                  "versionStartIncluding": "7.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-09-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": ".NET Core and Visual Studio Denial of Service Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T18:18:07.707Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": ".NET Core and Visual Studio Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
        }
      ],
      "title": ".NET Core and Visual Studio Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36799",
    "datePublished": "2023-09-12T16:58:38.681Z",
    "dateReserved": "2023-06-27T15:11:59.874Z",
    "dateUpdated": "2025-10-30T18:18:07.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-36799",
      "date": "2026-09-19",
      "epss": "0.04909",
      "percentile": "0.91702"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:6.0.0:-:*:*:*:*:*:*",
                  "matchCriteriaId": "1DE0C8DD-9C73-4876-8193-068F18074B58",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:7.0.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F4E2C6C0-FD91-40D9-B1A4-C1C348A156C7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E7698BEE-8540-4F0C-A500-1393055B88F4",
                  "versionEndExcluding": "17.2.19",
                  "versionStartIncluding": "17.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8174DBE5-A4BB-4FA6-B921-B2E82B08DAC9",
                  "versionEndExcluding": "17.4.11",
                  "versionStartIncluding": "17.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "16BAD93C-DFE9-4F94-99DC-230195CCD62A",
                  "versionEndExcluding": "17.6.7",
                  "versionStartIncluding": "17.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E8241557-9AD7-42D9-AF07-4C7C1A19AB53",
                  "versionEndExcluding": "17.7.4",
                  "versionStartIncluding": "17.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": ".NET Core and Visual Studio Denial of Service Vulnerability"
        },
        {
          "lang": "es",
          "value": "Vulnerabilidad de Denegaci\u00f3n de Servicio en .NET Core y Visual Studio"
        }
      ],
      "id": "CVE-2023-36799",
      "lastModified": "2024-11-21T08:10:36.957",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "source": "secure@microsoft.com",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-09-12T17:15:15.253",
      "references": [
        {
          "source": "secure@microsoft.com",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
        }
      ],
      "sourceIdentifier": "secure@microsoft.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-400"
            }
          ],
          "source": "secure@microsoft.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "platforms": [
                  "Unknown"
                ],
                "product": ".NET 6.0",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "6.0.24",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": ".NET 7.0",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "7.0.13",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": "Microsoft Visual Studio 2022 version 17.2",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "17.2.21",
                    "status": "affected",
                    "version": "17.2.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": "Microsoft Visual Studio 2022 version 17.4",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "17.4.13",
                    "status": "affected",
                    "version": "17.4.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": "Microsoft Visual Studio 2022 version 17.7",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "17.6.9",
                    "status": "affected",
                    "version": "17.7.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": "Microsoft Visual Studio 2022 version 17.6",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "17.6.9",
                    "status": "affected",
                    "version": "17.6.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": "PowerShell 7.2",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "7.2.14",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "Unknown"
                ],
                "product": "PowerShell 7.3",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "7.2.14",
                    "status": "affected",
                    "version": "7.3.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "secure@microsoft.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:.net:6.0.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1DE0C8DD-9C73-4876-8193-068F18074B58",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:.net:7.0.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4E2C6C0-FD91-40D9-B1A4-C1C348A156C7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7698BEE-8540-4F0C-A500-1393055B88F4",
                    "versionEndExcluding": "17.2.19",
                    "versionStartIncluding": "17.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8174DBE5-A4BB-4FA6-B921-B2E82B08DAC9",
                    "versionEndExcluding": "17.4.11",
                    "versionStartIncluding": "17.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "16BAD93C-DFE9-4F94-99DC-230195CCD62A",
                    "versionEndExcluding": "17.6.7",
                    "versionStartIncluding": "17.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E8241557-9AD7-42D9-AF07-4C7C1A19AB53",
                    "versionEndExcluding": "17.7.4",
                    "versionStartIncluding": "17.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": ".NET Core and Visual Studio Denial of Service Vulnerability"
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de Denegaci\u00f3n de Servicio en .NET Core y Visual Studio"
          }
        ],
        "id": "CVE-2023-36799",
        "lastModified": "2026-06-17T06:07:05.733",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "secure@microsoft.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-36799",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T16:23:47.132893Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-09-12T17:15:15.253",
        "references": [
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "secure@microsoft.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:54:33+00:00",
      "cve": "CVE-2023-36799",
      "id": "CVE-2023-36799",
      "initial_release_date": "2023-09-13T00:00:00+00:00",
      "product_status:fixed": "1052",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "dotnet: Denial of Service with Client Certificates using .NET Kestrel",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-36799.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-07-07T23:51:03Z",
      "cve": "CVE-2023-36799",
      "id": "CVE-2023-36799",
      "initial_release_date": "2023-10-31T02:18:48Z",
      "product_status:recommended": "41",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-36799",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-36799.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T17:01:09.676Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": ".NET Core and Visual Studio Denial of Service Vulnerability",
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-36799",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-29T16:23:47.132893Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-29T16:24:06.451Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "platforms": [
                "Unknown"
              ],
              "product": ".NET 6.0",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "6.0.24",
                  "status": "affected",
                  "version": "6.0.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": ".NET 7.0",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "7.0.13",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": "Microsoft Visual Studio 2022 version 17.2",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "17.2.21",
                  "status": "affected",
                  "version": "17.2.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": "Microsoft Visual Studio 2022 version 17.4",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "17.4.13",
                  "status": "affected",
                  "version": "17.4.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": "Microsoft Visual Studio 2022 version 17.7",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "17.6.9",
                  "status": "affected",
                  "version": "17.7.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": "Microsoft Visual Studio 2022 version 17.6",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "17.6.9",
                  "status": "affected",
                  "version": "17.6.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": "PowerShell 7.2",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "7.2.14",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "Unknown"
              ],
              "product": "PowerShell 7.3",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "7.2.14",
                  "status": "affected",
                  "version": "7.3.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.24",
                      "versionStartIncluding": "6.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.0.13",
                      "versionStartIncluding": "7.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "17.2.21",
                      "versionStartIncluding": "17.2.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "17.4.13",
                      "versionStartIncluding": "17.4.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "17.6.9",
                      "versionStartIncluding": "17.7.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "17.6.9",
                      "versionStartIncluding": "17.6.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2.14",
                      "versionStartIncluding": "7.2.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:powershell:*:-:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2.14",
                      "versionStartIncluding": "7.3.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "datePublic": "2023-09-12T07:00:00.000Z",
          "descriptions": [
            {
              "lang": "en-US",
              "value": ".NET Core and Visual Studio Denial of Service Vulnerability"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en-US",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-30T18:18:07.707Z",
            "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            "shortName": "microsoft"
          },
          "references": [
            {
              "name": ".NET Core and Visual Studio Denial of Service Vulnerability",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36799"
            }
          ],
          "title": ".NET Core and Visual Studio Denial of Service Vulnerability"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "assignerShortName": "microsoft",
        "cveId": "CVE-2023-36799",
        "datePublished": "2023-09-12T16:58:38.681Z",
        "dateReserved": "2023-06-27T15:11:59.874Z",
        "dateUpdated": "2025-10-30T18:18:07.707Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

RHSA-2023_6247

Vulnerability from csaf_redhat - Published: 2023-11-01 15:06 - Updated: 2024-11-23 00:24

Summary

Red Hat Security Advisory: .NET 7.0 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2023-36799.

CVE-2023-36799

A vulnerability was found in dotnet. This issue can lead to a denial of service when processing X.509 certificates.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 154 products

https://access.redhat.com/errata/RHSA-2023:6247

Open the full advisory

RHSA-2023_6249

Vulnerability from csaf_redhat - Published: 2023-11-01 14:56 - Updated: 2024-11-23 00:24

Summary

Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2023-36799.

CVE-2023-36799

A vulnerability was found in dotnet. This issue can lead to a denial of service when processing X.509 certificates.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 42 products

https://access.redhat.com/errata/RHSA-2023:6249

Open the full advisory

SSA-341067

Vulnerability from csaf_siemens - Published: 2024-06-11 00:00 - Updated: 2024-06-11 00:00

Summary

SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1

Scope

37 vulnerabilities in this advisory, including CVE-2023-36799.

CVE-2023-36799

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Known affected: 1 product

https://support.industry.siemens.com/cs/ww/en/view/109955597/

Open the full advisory

UBUNTU-CVE-2023-36799 (CVE-2023-36799)

Vulnerability from osv_ubuntu – Published: 2023-09-12 00:00 – Updated: 2025-09-08 16:56 – Source website

Details

.NET Core and Visual Studio Denial of Service Vulnerability

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-36799	REPORT
	https://ubuntu.com/security/notices/USN-6362-1	ADVISORY
	https://devblogs.microsoft.com/dotnet/september-2…	REPORT
	https://ubuntu.com/security/notices/USN-6438-1	ADVISORY
	https://ubuntu.com/security/notices/USN-6438-2	ADVISORY
	https://ubuntu.com/security/notices/USN-6362-2	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2023-36799	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-host",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-hostfxr-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-runtime-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-sdk-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-sdk-6.0-source-built-artifacts",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-templates-6.0",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet6",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1",
            "binary_version": "6.0.122-0ubuntu1~22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "dotnet6",
        "purl": "pkg:deb/ubuntu/dotnet6@6.0.122-0ubuntu1~22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.122-0ubuntu1~22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.0.108-0ubuntu1~22.04.1",
        "6.0.109-0ubuntu1~22.04.1",
        "6.0.110-0ubuntu1~22.04.1",
        "6.0.111-0ubuntu1~22.04.1",
        "6.0.113-0ubuntu1~22.04.1",
        "6.0.116-0ubuntu1~22.04.1",
        "6.0.118-0ubuntu1~22.04.1",
        "6.0.119-0ubuntu1~22.04.1",
        "6.0.120-0ubuntu1~22.04.1",
        "6.0.121-0ubuntu1~22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-host-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-hostfxr-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-runtime-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0-source-built-artifacts",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-templates-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet7",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1-7.0",
            "binary_version": "7.0.111-0ubuntu1~22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "dotnet7",
        "purl": "pkg:deb/ubuntu/dotnet7@7.0.111-0ubuntu1~22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.111-0ubuntu1~22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.105-0ubuntu1~22.04.1",
        "7.0.107-0ubuntu1~22.04.1",
        "7.0.108-0ubuntu1~22.04.1",
        "7.0.109-0ubuntu1~22.04.1",
        "7.0.110-0ubuntu1~22.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": ".NET Core and Visual Studio Denial of Service Vulnerability",
  "id": "UBUNTU-CVE-2023-36799",
  "modified": "2025-09-08T16:56:24Z",
  "published": "2023-09-12T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-36799"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6362-1"
    },
    {
      "type": "REPORT",
      "url": "https://devblogs.microsoft.com/dotnet/september-2023-updates/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6438-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6438-2"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6362-2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36799"
    }
  ],
  "related": [
    "USN-6362-1",
    "USN-6438-1",
    "USN-6438-2",
    "USN-6362-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-36799"
  ]
}

USN-6438-1

Vulnerability from osv_ubuntu – Published: 2023-10-19 16:12 – Updated: 2023-10-19 16:12 – Source website

Summary

dotnet6, dotnet7 vulnerabilities

Details

Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-36799)

It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-44487)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6438-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-36799	REPORT
	https://ubuntu.com/security/CVE-2023-44487	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-apphost-pack-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-apphost-pack-6.0-dbgsym",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-host",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-host-dbgsym",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-hostfxr-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-hostfxr-6.0-dbgsym",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-runtime-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-runtime-6.0-dbgsym",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-sdk-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-sdk-6.0-dbgsym",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-sdk-6.0-source-built-artifacts",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-targeting-pack-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet-templates-6.0",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "dotnet6",
            "binary_version": "6.0.123-0ubuntu1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1",
            "binary_version": "6.0.123-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:23.10",
        "name": "dotnet6",
        "purl": "pkg:deb/ubuntu/dotnet6@6.0.123-0ubuntu1?arch=source\u0026distro=mantic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.123-0ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.0.116-0ubuntu2",
        "6.0.116-0ubuntu3",
        "6.0.118-0ubuntu1",
        "6.0.119-0ubuntu1",
        "6.0.120-0ubuntu1",
        "6.0.120-0ubuntu2",
        "6.0.121-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-apphost-pack-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-apphost-pack-7.0-dbgsym",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-host-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-host-7.0-dbgsym",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-hostfxr-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-hostfxr-7.0-dbgsym",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-runtime-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-runtime-7.0-dbgsym",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-sdk-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-sdk-7.0-dbgsym",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-sdk-7.0-source-built-artifacts",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-targeting-pack-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet-templates-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "dotnet7",
            "binary_version": "7.0.112-0ubuntu1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1-7.0",
            "binary_version": "7.0.112-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:23.10",
        "name": "dotnet7",
        "purl": "pkg:deb/ubuntu/dotnet7@7.0.112-0ubuntu1?arch=source\u0026distro=mantic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.112-0ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.105-0ubuntu2",
        "7.0.105-0ubuntu3",
        "7.0.107-0ubuntu1",
        "7.0.108-0ubuntu2",
        "7.0.109-0ubuntu1",
        "7.0.109-0ubuntu2",
        "7.0.110-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Kevin Jones discovered that .NET did not properly process certain\nX.509 certificates. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2023-36799)\n\nIt was discovered that the .NET Kestrel web server did not properly\nhandle HTTP/2 requests. A remote attacker could possibly use this\nissue to cause a denial of service. (CVE-2023-44487)\n",
  "id": "USN-6438-1",
  "modified": "2023-10-19T16:12:40.635566Z",
  "published": "2023-10-19T16:12:40.635566Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6438-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-36799"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-44487"
    }
  ],
  "related": [
    "CVE-2023-36799",
    "UBUNTU-CVE-2023-36799",
    "CVE-2023-44487",
    "UBUNTU-CVE-2023-44487"
  ],
  "schema_version": "1.6.3",
  "summary": "dotnet6, dotnet7 vulnerabilities"
}

USN-6438-2

Vulnerability from osv_ubuntu – Published: 2023-10-25 03:44 – Updated: 2023-10-25 03:44 – Source website

Summary

.Net regressions

Details

USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix for CVE-2023-36799 was incomplete. This update fixes the problem.

Original advisory details:

Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-36799)

It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-44487)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6438-2	ADVISORY
	https://ubuntu.com/security/CVE-2023-36799	REPORT
	https://launchpad.net/bugs/2040207	REPORT
	https://launchpad.net/bugs/2040208	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-6.0-dbgsym",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-host",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-host-dbgsym",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-hostfxr-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-hostfxr-6.0-dbgsym",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-runtime-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-runtime-6.0-dbgsym",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-sdk-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-sdk-6.0-dbgsym",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-sdk-6.0-source-built-artifacts",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-templates-6.0",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet6",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1",
            "binary_version": "6.0.124-0ubuntu1~23.10.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:23.10",
        "name": "dotnet6",
        "purl": "pkg:deb/ubuntu/dotnet6@6.0.124-0ubuntu1~23.10.1?arch=source\u0026distro=mantic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.124-0ubuntu1~23.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.0.116-0ubuntu2",
        "6.0.116-0ubuntu3",
        "6.0.118-0ubuntu1",
        "6.0.119-0ubuntu1",
        "6.0.120-0ubuntu1",
        "6.0.120-0ubuntu2",
        "6.0.121-0ubuntu1",
        "6.0.123-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-7.0-dbgsym",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-host-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-host-7.0-dbgsym",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-hostfxr-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-hostfxr-7.0-dbgsym",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-runtime-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-runtime-7.0-dbgsym",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0-dbgsym",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0-source-built-artifacts",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet-templates-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "dotnet7",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1-7.0",
            "binary_version": "7.0.113-0ubuntu1~23.10.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:23.10",
        "name": "dotnet7",
        "purl": "pkg:deb/ubuntu/dotnet7@7.0.113-0ubuntu1~23.10.1?arch=source\u0026distro=mantic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.113-0ubuntu1~23.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.105-0ubuntu2",
        "7.0.105-0ubuntu3",
        "7.0.107-0ubuntu1",
        "7.0.108-0ubuntu2",
        "7.0.109-0ubuntu1",
        "7.0.109-0ubuntu2",
        "7.0.110-0ubuntu1",
        "7.0.112-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix\nfor [CVE-2023-36799](https://ubuntu.com/security/CVE-2023-36799) was incomplete. This update fixes the problem.\n\nOriginal advisory details:\n\n Kevin Jones discovered that .NET did not properly process certain\n X.509 certificates. An attacker could possibly use this issue to\n cause a denial of service. (CVE-2023-36799)\n \n It was discovered that the .NET Kestrel web server did not properly\n handle HTTP/2 requests. A remote attacker could possibly use this\n issue to cause a denial of service. (CVE-2023-44487)\n",
  "id": "USN-6438-2",
  "modified": "2023-10-25T03:44:47.079002Z",
  "published": "2023-10-25T03:44:47.079002Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6438-2"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-36799"
    },
    {
      "type": "REPORT",
      "url": "https://launchpad.net/bugs/2040207"
    },
    {
      "type": "REPORT",
      "url": "https://launchpad.net/bugs/2040208"
    }
  ],
  "related": [
    "CVE-2023-36799",
    "UBUNTU-CVE-2023-36799"
  ],
  "schema_version": "1.6.3",
  "summary": ".Net regressions"
}

WID-SEC-W-2023-2333

Vulnerability from csaf_certbund - Published: 2023-09-12 22:00 - Updated: 2023-11-21 23:00

Summary

Microsoft Developer Tools: Mehrere Schwachstellen

Severity

Hoch

Scope

12 vulnerabilities in this advisory, including CVE-2023-36799.

CVE-2023-36799

Es existieren mehrere Schwachstellen in verschiedenen Microsoft Developer Tools. Die Fehler sind noch nicht im Detail beschrieben. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen und seine Privilegien auf SYSTEM zu erweitern. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.

Known affected: 24 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-36799 (GCVE-0-2023-36799)

RHSA-2023_6247

RHSA-2023_6249

SSA-341067

UBUNTU-CVE-2023-36799 (CVE-2023-36799)

USN-6438-1

USN-6438-2

WID-SEC-W-2023-2333

Tags

Sightings

Nomenclature

Related by attack behaviour