.NET and Visual Studio Information Disclosure Vulnerability

An update of the dotnet package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0133 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-13950:
    Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service

    CVE-2020-35452:
    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

    CVE-2021-33193:
    A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead     to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

    CVE-2021-36160:
    A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and     crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

    CVE-2022-30184:
    .NET and Visual Studio Information Disclosure Vulnerability.

    CVE-2021-44224:
    A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:5050 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5061 advisory.

  - .NET and Visual Studio Information Disclosure Vulnerability. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5046 advisory.

  - .NET and Visual Studio Information Disclosure Vulnerability. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5050 advisory.

    [6.0.106-1.0.1]
    - Add missing Oracle RIDs
    - Build all packages on source-build even when in servicing

    [6.0.106-1]
    - Update to .NET SDK 6.0.106 and Runtime 6.0.6
    - Resolves: RHBZ#2093433

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A potential privilege escalation vulnerability. An attacker can exploit this to elevate their privileges.     (CVE-2022-24513)

  - A potetnial Denial Of Service vulnerability. An attacker can exploit this to create a denial of service.     (CVE-2022-23267)

  - An information disclosure vulnerability. An attacker canm exploit this to disclose potentially sensitive     information. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5046 advisory.

    [6.0.106-1.0.1]
    - Add missing Oracle RIDs

    [6.0.106-1]
    - Update to .NET SDK 6.0.106 and Runtime 6.0.6
    - Resolves: RHBZ#2093432

    [6.0.105-1]
    - Update to .NET SDK 6.0.105 and Runtime 6.0.5
    - Resolves: RHBZ#2082267

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.     (CVE-2022-24513)

  - An information disclosure vulnerability exists in Visual Studio. An unauthenticated, remote attacker can exploit     this to disclose potentially sensitive information. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An information disclosure vulnerability exists in .NET core 6.0 < 6.0.6 and .NET Core 3.1 < 3.1.26. An unauthenticated, local attacker can exploit this, to disclose potentially sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5061 advisory.

    [3.1.420-1.0.1]
    - Add missing Oracle Linux Runtime IDs
    - Update to .NET SDK 3.1.417 and Runtime 3.1.23
    - Resolves: RHBZ#2060566

    [3.1.420-1]
    - Update to .NET SDK 3.1.420 and Runtime 3.1.26
    - Resolves: RHBZ#2096319

    [3.1.419-1]
    - Update to .NET SDK 3.1.419 and Runtime 3.1.25
    - Resolves: RHBZ#2081443

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5061 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.420 and .NET Runtime 3.1.26.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5050 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.106 and .NET Runtime 6.0.6.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5062 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.420 and .NET Runtime 3.1.26.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5046 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.106 and .NET Runtime 6.0.6.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5047 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.106 and .NET Runtime 6.0.6.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	high
236430	Alibaba Cloud Linux 3 : 0133: httpd:2.4 (ALINUX3-SA-2022:0133)	Nessus	Alibaba Cloud Linux Local Security Checks	high
234310	Photon OS 5.0: Dotnet PHSA-2025-5.0-0499	Nessus	PhotonOS Local Security Checks	critical
167655	AlmaLinux 9 : .NET 6.0 (ALSA-2022:5050)	Nessus	Alma Linux Local Security Checks	medium
162851	Rocky Linux 8 : .NET Core 3.1 (RLSA-2022:5061)	Nessus	Rocky Linux Local Security Checks	medium
162848	Rocky Linux 8 : .NET 6.0 (RLSA-2022:5046)	Nessus	Rocky Linux Local Security Checks	medium
162792	Oracle Linux 9 : .NET / 6.0 (ELSA-2022-5050)	Nessus	Oracle Linux Local Security Checks	medium
162392	Security Updates for Visual Studio 2019/2022 (June 2022) (macOS)	Nessus	Windows : Microsoft Bulletins	high
162332	Oracle Linux 8 : .NET / 6.0 (ELSA-2022-5046)	Nessus	Oracle Linux Local Security Checks	medium
162317	Security Updates for Microsoft Visual Studio Products (June 2022)	Nessus	Windows : Microsoft Bulletins	high
162314	Security Updates for Microsoft .NET core (June 2022)	Nessus	Windows	medium
162307	Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2022-5061)	Nessus	Oracle Linux Local Security Checks	medium
162305	RHEL 8 : .NET Core 3.1 (RHSA-2022:5061)	Nessus	Red Hat Local Security Checks	medium
162304	RHEL 9 : .NET 6.0 (RHSA-2022:5050)	Nessus	Red Hat Local Security Checks	medium
162302	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:5062)	Nessus	Red Hat Local Security Checks	medium
162231	RHEL 8 : .NET 6.0 (RHSA-2022:5046)	Nessus	Red Hat Local Security Checks	medium
162229	RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:5047)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2022-30184

medium

Tenable Plugins

high

high

critical

medium

medium

medium

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium