First published: Tue Mar 11 2025(Updated: )
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.<br>New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es):<br><li> dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070)</li> Bug Fix(es) and Enhancement(s):<br><li> dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software | Affected Version | How to fix |
---|---|---|
Red Hat CodeReady Linux Builder for ARM 64 | ||
Red Hat Enterprise Linux 8 | ||
Red Hat Enterprise Linux Server for IBM z Systems | ||
Red Hat Enterprise Linux for Power, little endian - Extended Update Support | ||
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support | ||
Red Hat Enterprise Linux for ARM 64 | ||
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support | ||
Red Hat CodeReady Linux Builder for IBM z Systems | ||
redhat/dotnet9.0 | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/aspnetcore-runtime | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/aspnetcore-runtime-dbg | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/aspnetcore-targeting-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/dotnet-apphost-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-apphost-pack | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-host | <9.0.3-1.el8_10 | 9.0.3-1.el8_10 |
redhat/dotnet-host-debuginfo | <9.0.3-1.el8_10 | 9.0.3-1.el8_10 |
redhat/dotnet-hostfxr | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-hostfxr | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-runtime | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-runtime | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-runtime-dbg | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-sdk | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-sdk | <9.0-debuginfo-9.0.104-1.el8_10 | 9.0-debuginfo-9.0.104-1.el8_10 |
redhat/dotnet-sdk-aot | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-sdk-aot | <9.0-debuginfo-9.0.104-1.el8_10 | 9.0-debuginfo-9.0.104-1.el8_10 |
redhat/dotnet-sdk-dbg | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-targeting-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-templates | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet9.0-debuginfo | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/dotnet9.0-debugsource | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/netstandard-targeting-pack | <2.1-9.0.104-1.el8_10 | 2.1-9.0.104-1.el8_10 |
redhat/aspnetcore-runtime | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/aspnetcore-runtime-dbg | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/aspnetcore-targeting-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/dotnet-apphost-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-apphost-pack | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-host | <9.0.3-1.el8_10 | 9.0.3-1.el8_10 |
redhat/dotnet-host-debuginfo | <9.0.3-1.el8_10 | 9.0.3-1.el8_10 |
redhat/dotnet-hostfxr | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-hostfxr | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-runtime | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-runtime | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-runtime-dbg | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-sdk | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-sdk | <9.0-debuginfo-9.0.104-1.el8_10 | 9.0-debuginfo-9.0.104-1.el8_10 |
redhat/dotnet-sdk-dbg | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-targeting-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-templates | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet9.0-debuginfo | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/dotnet9.0-debugsource | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/netstandard-targeting-pack | <2.1-9.0.104-1.el8_10 | 2.1-9.0.104-1.el8_10 |
redhat/aspnetcore-runtime | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/aspnetcore-runtime-dbg | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/aspnetcore-targeting-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/dotnet-apphost-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-apphost-pack | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-host | <9.0.3-1.el8_10 | 9.0.3-1.el8_10 |
redhat/dotnet-host-debuginfo | <9.0.3-1.el8_10 | 9.0.3-1.el8_10 |
redhat/dotnet-hostfxr | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-hostfxr | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-runtime | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-runtime | <9.0-debuginfo-9.0.3-1.el8_10 | 9.0-debuginfo-9.0.3-1.el8_10 |
redhat/dotnet-runtime-dbg | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-sdk | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-sdk | <9.0-debuginfo-9.0.104-1.el8_10 | 9.0-debuginfo-9.0.104-1.el8_10 |
redhat/dotnet-sdk-dbg | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet-targeting-pack | <9.0-9.0.3-1.el8_10 | 9.0-9.0.3-1.el8_10 |
redhat/dotnet-templates | <9.0-9.0.104-1.el8_10 | 9.0-9.0.104-1.el8_10 |
redhat/dotnet9.0-debuginfo | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/dotnet9.0-debugsource | <9.0.104-1.el8_10 | 9.0.104-1.el8_10 |
redhat/netstandard-targeting-pack | <2.1-9.0.104-1.el8_10 | 2.1-9.0.104-1.el8_10 |
redhat/aspnetcore-runtime | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/aspnetcore-runtime-dbg | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/aspnetcore-targeting-pack | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/dotnet | <9.0.104-1.el8_10.aa | 9.0.104-1.el8_10.aa |
redhat/dotnet-apphost-pack | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/dotnet-apphost-pack | <9.0-debuginfo-9.0.3-1.el8_10.aa | 9.0-debuginfo-9.0.3-1.el8_10.aa |
redhat/dotnet-host | <9.0.3-1.el8_10.aa | 9.0.3-1.el8_10.aa |
redhat/dotnet-host-debuginfo | <9.0.3-1.el8_10.aa | 9.0.3-1.el8_10.aa |
redhat/dotnet-hostfxr | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/dotnet-hostfxr | <9.0-debuginfo-9.0.3-1.el8_10.aa | 9.0-debuginfo-9.0.3-1.el8_10.aa |
redhat/dotnet-runtime | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/dotnet-runtime | <9.0-debuginfo-9.0.3-1.el8_10.aa | 9.0-debuginfo-9.0.3-1.el8_10.aa |
redhat/dotnet-runtime-dbg | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/dotnet-sdk | <9.0-9.0.104-1.el8_10.aa | 9.0-9.0.104-1.el8_10.aa |
redhat/dotnet-sdk | <9.0-debuginfo-9.0.104-1.el8_10.aa | 9.0-debuginfo-9.0.104-1.el8_10.aa |
redhat/dotnet-sdk-aot | <9.0-9.0.104-1.el8_10.aa | 9.0-9.0.104-1.el8_10.aa |
redhat/dotnet-sdk-aot | <9.0-debuginfo-9.0.104-1.el8_10.aa | 9.0-debuginfo-9.0.104-1.el8_10.aa |
redhat/dotnet-sdk-dbg | <9.0-9.0.104-1.el8_10.aa | 9.0-9.0.104-1.el8_10.aa |
redhat/dotnet-targeting-pack | <9.0-9.0.3-1.el8_10.aa | 9.0-9.0.3-1.el8_10.aa |
redhat/dotnet-templates | <9.0-9.0.104-1.el8_10.aa | 9.0-9.0.104-1.el8_10.aa |
redhat/dotnet9.0-debuginfo | <9.0.104-1.el8_10.aa | 9.0.104-1.el8_10.aa |
redhat/dotnet9.0-debugsource | <9.0.104-1.el8_10.aa | 9.0.104-1.el8_10.aa |
redhat/netstandard-targeting-pack | <2.1-9.0.104-1.el8_10.aa | 2.1-9.0.104-1.el8_10.aa |
redhat/dotnet-sdk | <9.0-source-built-artifacts-9.0.104-1.el8_10 | 9.0-source-built-artifacts-9.0.104-1.el8_10 |
redhat/dotnet-sdk | <9.0-source-built-artifacts-9.0.104-1.el8_10 | 9.0-source-built-artifacts-9.0.104-1.el8_10 |
redhat/dotnet-sdk | <9.0-source-built-artifacts-9.0.104-1.el8_10.aa | 9.0-source-built-artifacts-9.0.104-1.el8_10.aa |
redhat/dotnet-sdk | <9.0-source-built-artifacts-9.0.104-1.el8_10 | 9.0-source-built-artifacts-9.0.104-1.el8_10 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of RHSA-2025:2667 is classified as important.
To fix RHSA-2025:2667, update your .NET SDK to version 9.0.104 or its corresponding runtime versions.
The affected software includes various versions of Red Hat Enterprise Linux and CodeReady Builder for multiple architectures.
The update for RHSA-2025:2667 provides .NET SDK version 9.0.104 and related runtime packages.
Yes, the update for RHSA-2025:2667 is available for x86_64, ARM 64, IBM z Systems, and Power architectures.