.NET and Visual Studio Denial of Service Vulnerability

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4588 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-4588 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29117. (CVE-2022-29145)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-29117,     CVE-2022-29145. (CVE-2022-23267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A potential privilege escalation vulnerability. An attacker can exploit this to elevate their privileges.     (CVE-2022-24513)

  - A potetnial Denial Of Service vulnerability. An attacker can exploit this to create a denial of service.     (CVE-2022-23267)

  - An information disclosure vulnerability. An attacker canm exploit this to disclose potentially sensitive     information. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-2199 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29117. (CVE-2022-29145)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-29117,     CVE-2022-29145. (CVE-2022-23267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-2202 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29117. (CVE-2022-29145)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-29117,     CVE-2022-29145. (CVE-2022-23267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-2200 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29117. (CVE-2022-29145)

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-29117,     CVE-2022-29145. (CVE-2022-23267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2202 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2200 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2199 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267,     CVE-2022-29145. (CVE-2022-29117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET core installations on the remote host are missing security updates. It is, therefore, affected by multiple denial of service vulnerabilities:

  - A vulnerability where a malicious client can cause a denial of service via excess memory allocations     through HttpClient. (CVE-2022-23267)

  - A vulnerability where a malicious client can manipulate cookies and cause a denial of service. (CVE-2022-29117)

  - A vulnerability where a malicious client can cause a denial of service when HTML forms are parsed. (CVE-2022-29145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2194 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by denial of service vulnerability:

  - A denial of service (DoS) vulnerability exists in Microsoft Visual Studio 2019. An unauthenticated,     remote attacker can exploit this issue to cause the application to stop responding.     (CVE-2022-29145, CVE-2022-23267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.     (CVE-2022-24513)

  - Multiple denial of service (DoS) vulnerabilities. An unauthenticated, remote attacker can exploit this to     cause a DoS condition. (CVE-2022-29117, CVE-2022-23267, CVE-2022-29145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2200 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2202 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2195 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2196 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2199 advisory.

  - dotnet: excess memory allocation via HttpClient causes DoS (CVE-2022-23267)

  - dotnet: malicious content causes high CPU and memory usage (CVE-2022-29117)

  - dotnet: parsing HTML causes Denial of Service (CVE-2022-29145)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
164851	RHEL 9 : .NET 6.0 (RHSA-2022:4588)	Nessus	Red Hat Local Security Checks	high
162787	Oracle Linux 9 : .NET / 6.0 (ELSA-2022-4588)	Nessus	Oracle Linux Local Security Checks	high
162392	Security Updates for Visual Studio 2019/2022 (June 2022) (macOS)	Nessus	Windows : Microsoft Bulletins	high
161381	Oracle Linux 8 : .NET / 6.0 (ELSA-2022-2199)	Nessus	Oracle Linux Local Security Checks	high
161378	Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2022-2202)	Nessus	Oracle Linux Local Security Checks	high
161377	Oracle Linux 8 : .NET / 5.0 (ELSA-2022-2200)	Nessus	Oracle Linux Local Security Checks	high
161347	Rocky Linux 8 : .NET Core 3.1 (RLSA-2022:2202)	Nessus	Rocky Linux Local Security Checks	high
161345	Rocky Linux 8 : .NET 5.0 (RLSA-2022:2200)	Nessus	Rocky Linux Local Security Checks	high
161334	Rocky Linux 8 : .NET 6.0 (RLSA-2022:2199)	Nessus	Rocky Linux Local Security Checks	high
161167	Security Updates for Microsoft .NET core (May 2022)	Nessus	Misc.	high
161152	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:2194)	Nessus	Red Hat Local Security Checks	high
161121	Security Update for Visual Studio 2019 (May 2022) (macOS)	Nessus	MacOS X Local Security Checks	high
161118	Security Updates for Microsoft Visual Studio Products (May 2022)	Nessus	Windows : Microsoft Bulletins	high
161081	RHEL 8 : .NET 5.0 (RHSA-2022:2200)	Nessus	Red Hat Local Security Checks	high
161078	RHEL 8 : .NET Core 3.1 (RHSA-2022:2202)	Nessus	Red Hat Local Security Checks	high
161075	RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:2195)	Nessus	Red Hat Local Security Checks	high
161074	RHEL 7 : .NET 5.0 on RHEL 7 (RHSA-2022:2196)	Nessus	Red Hat Local Security Checks	high
161067	RHEL 8 : .NET 6.0 (RHSA-2022:2199)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-23267

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high