.NET and Visual Studio Denial of Service Vulnerability

An update of the powershell package has been released.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1308 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1311 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1308 advisory.

    [7.0.117-1.0.1]
    - Update to .NET SDK 7.0.117 and Runtime 7.0.17
    - Port Revert 'Disable implicit rejection for RSA PKCS#1 (#95217) patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1309 advisory.

    [- 7.0.117-1.0.1]
    - Update to .NET SDK 7.0.117 and Runtime 7.0.17
    - Port revert 'Disable implicit rejection for RSA PKCS#1 (#95217)' patch

    [- 7.0.116-1.0.1]
    - Update to .NET SDK 7.0.116 and Runtime 7.0.16

    * Tue Jan 16 2024 Lukas Lipinsky - 7.0.115-1.0.1
    - Update to .NET SDK 7.0.115 and Runtime 7.0.15

    [7.0.114-1.0.1]
    - Update to .NET SDK 7.0.114 and Runtime 7.0.14

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1310 advisory.

    [- 8.0.103-2.0.1]
    - Update to .NET SDK 8.0.103 and Runtime 8.0.3
    - Disable checking the signature of the last certificate in a chain if the certificate is supposedly self-     signed.
    - Resolves: RHEL-25254
    - Backport MSBuild locale fix
    - Resolves: RHEL-23936

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1311 advisory.

    [8.0.103-1.0.1]
    - Update to .NET SDK 8.0.103 and Runtime 8.0.3
    - Backport MSBuild locale fix

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1310 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1309 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1308 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1311 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1310 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.103 and .NET Runtime 8.0.3.

    Security Fix(es):

    * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1311 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.103 and .NET Runtime 8.0.3.

    Security Fix(es):

    * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1308 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.117 and .NET Runtime 7.0.17.

    Security Fix(es):

    * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1309 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.117 and .NET Runtime 7.0.17.

    Security Fix(es):

    * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.27, 7.x prior to 7.0.16 or 8.x prior to 8.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the February 2024 advisory:

  - A vulnerability exists in .NET where specially crafted requests may cause a resource leak, leading to a     denial of service. (CVE-2024-21392)

  - A Vulnerability exist in MsQuic.dll which might result in a peer to allocate small chunks of memory as     long as connection stays alive. (CVE-2024-26190) 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2024_Mar_12 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6693-1 advisory.

    It was discovered that .NET did not properly handle certain specially crafted requests. An attacker could     potentially use this issue to cause a resource leak, leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple denial of service vulnerabilities. An attacker can exploit these issues to cause the affected component to deny system or application services.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
235793	Photon OS 5.0: Powershell PHSA-2024-5.0-0316	Nessus	PhotonOS Local Security Checks	high
192615	Rocky Linux 8 : .NET 7.0 (RLSA-2024:1308)	Nessus	Rocky Linux Local Security Checks	high
192606	Rocky Linux 8 : .NET 8.0 (RLSA-2024:1311)	Nessus	Rocky Linux Local Security Checks	high
192173	Oracle Linux 8 : .NET / 7.0 (ELSA-2024-1308)	Nessus	Oracle Linux Local Security Checks	high
192137	Oracle Linux 9 : .NET / 7.0 (ELSA-2024-1309)	Nessus	Oracle Linux Local Security Checks	high
192136	Oracle Linux 9 : .NET / 8.0 (ELSA-2024-1310)	Nessus	Oracle Linux Local Security Checks	high
192135	Oracle Linux 8 : .NET / 8.0 (ELSA-2024-1311)	Nessus	Oracle Linux Local Security Checks	high
192122	AlmaLinux 9 : .NET 8.0 (ALSA-2024:1310)	Nessus	Alma Linux Local Security Checks	high
192121	AlmaLinux 9 : .NET 7.0 (ALSA-2024:1309)	Nessus	Alma Linux Local Security Checks	high
192112	AlmaLinux 8 : .NET 7.0 (ALSA-2024:1308)	Nessus	Alma Linux Local Security Checks	high
192111	AlmaLinux 8 : .NET 8.0 (ALSA-2024:1311)	Nessus	Alma Linux Local Security Checks	high
192040	RHEL 9 : .NET 8.0 (RHSA-2024:1310)	Nessus	Red Hat Local Security Checks	high
192038	RHEL 8 : .NET 8.0 (RHSA-2024:1311)	Nessus	Red Hat Local Security Checks	high
192037	RHEL 8 : .NET 7.0 (RHSA-2024:1308)	Nessus	Red Hat Local Security Checks	high
192034	RHEL 9 : .NET 7.0 (RHSA-2024:1309)	Nessus	Red Hat Local Security Checks	high
192026	Security Update for Microsoft .NET Core SDK (March 2024)	Nessus	Windows	high
192012	Security Update for Microsoft .NET Core (March 2024)	Nessus	Windows	high
191960	Ubuntu 22.04 LTS / 23.10 : .NET vulnerability (USN-6693-1)	Nessus	Ubuntu Local Security Checks	high
191932	Security Updates for Microsoft Visual Studio Products (March 2024)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2024-21392

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high