The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7058-1 advisory.

    Brennan Conroy discovered that the .NET Kestrel web server did not properly handle closing HTTP/3 streams     under certain circumstances. An attacker could possibly use this issue to achieve remote code execution.
    This vulnerability only impacted .NET8. (CVE-2024-38229)

    It was discovered that .NET components designed to process malicious input were susceptible to hash     flooding attacks. An attacker could possibly use this issue to cause a denial of service, resulting in a     crash. (CVE-2024-43483)

    It was discovered that the .NET System.IO.Packaging namespace did not properly process SortedList data     structures. An attacker could possibly use this issue to cause a denial of service, resulting in a crash.
    (CVE-2024-43484)

    It was discovered that .NET did not properly handle the deserialization of of certain JSON properties. An     attacker could possibly use this issue to cause a denial of service, resulting in a crash.
    (CVE-2024-43485)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 22.04 LTS / 24.04 LTS : .NET vulnerabilities (USN-7058-1)

high Nessus Plugin ID 208306

Version 1.2

Version 1.1

Version 1.2 May 7, 2025, 8:43 AM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") CVSSv2 score source (changed from "CVE-2024-38229" to "CVE-2024-43485") Plugin Feed: 202505070843
Version 1.1 Oct 9, 2024, 2:59 AM New Plugin Feed: 202410090259