USN-6578-1: .NET vulnerabilities
Published Jan 11, 2024
·Updated
Vishal Mishra and Anita Gaud discovered that .NET did not properly validate X.509 certificates with malformed signatures. An attacker could possibly use this issue to bypass an application's typical authentication logic. (CVE-2024-0057) Morgan Brown discovered that .NET did not properly handle requests from unauthenticated clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21319)
Affected Software
84 affected componentsFixes available
All of the following
ubuntu/aspnetcore-runtime-6.0<6.0.126-0ubuntu1~23.10.1
6.0.126-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/aspnetcore-runtime-7.0<7.0.115-0ubuntu1~23.10.1
7.0.115-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/aspnetcore-runtime-8.0<8.0.1-0ubuntu1~23.10.1
8.0.1-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-host<6.0.126-0ubuntu1~23.10.1
6.0.126-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-host-7.0<7.0.115-0ubuntu1~23.10.1
7.0.115-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-host-8.0<8.0.1-0ubuntu1~23.10.1
8.0.1-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-hostfxr-6.0<6.0.126-0ubuntu1~23.10.1
6.0.126-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-hostfxr-7.0<7.0.115-0ubuntu1~23.10.1
7.0.115-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-hostfxr-8.0<8.0.1-0ubuntu1~23.10.1
8.0.1-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-runtime-6.0<6.0.126-0ubuntu1~23.10.1
6.0.126-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-runtime-7.0<7.0.115-0ubuntu1~23.10.1
7.0.115-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-runtime-8.0<8.0.1-0ubuntu1~23.10.1
8.0.1-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-sdk-6.0<6.0.126-0ubuntu1~23.10.1
6.0.126-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-sdk-7.0<7.0.115-0ubuntu1~23.10.1
7.0.115-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet-sdk-8.0<8.0.101-0ubuntu1~23.10.1
8.0.101-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet6<6.0.126-0ubuntu1~23.10.1
6.0.126-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet7<7.0.115-0ubuntu1~23.10.1
7.0.115-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/dotnet8<8.0.101-8.0.1-0ubuntu1~23.10.1
8.0.101-8.0.1-0ubuntu1~23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/aspnetcore-runtime-6.0<6.0.126-0ubuntu1~23.04.1
6.0.126-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/aspnetcore-runtime-7.0<7.0.115-0ubuntu1~23.04.1
7.0.115-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-host<6.0.126-0ubuntu1~23.04.1
6.0.126-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-host-7.0<7.0.115-0ubuntu1~23.04.1
7.0.115-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-hostfxr-6.0<6.0.126-0ubuntu1~23.04.1
6.0.126-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-hostfxr-7.0<7.0.115-0ubuntu1~23.04.1
7.0.115-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-runtime-6.0<6.0.126-0ubuntu1~23.04.1
6.0.126-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-runtime-7.0<7.0.115-0ubuntu1~23.04.1
7.0.115-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-sdk-6.0<6.0.126-0ubuntu1~23.04.1
6.0.126-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet-sdk-7.0<7.0.115-0ubuntu1~23.04.1
7.0.115-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet6<6.0.126-0ubuntu1~23.04.1
6.0.126-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/dotnet7<7.0.115-0ubuntu1~23.04.1
7.0.115-0ubuntu1~23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/aspnetcore-runtime-6.0<6.0.126-0ubuntu1~22.04.1
6.0.126-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/aspnetcore-runtime-7.0<7.0.115-0ubuntu1~22.04.1
7.0.115-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-host<6.0.126-0ubuntu1~22.04.1
6.0.126-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-host-7.0<7.0.115-0ubuntu1~22.04.1
7.0.115-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-hostfxr-6.0<6.0.126-0ubuntu1~22.04.1
6.0.126-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-hostfxr-7.0<7.0.115-0ubuntu1~22.04.1
7.0.115-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-runtime-6.0<6.0.126-0ubuntu1~22.04.1
6.0.126-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-runtime-7.0<7.0.115-0ubuntu1~22.04.1
7.0.115-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-sdk-6.0<6.0.126-0ubuntu1~22.04.1
6.0.126-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet-sdk-7.0<7.0.115-0ubuntu1~22.04.1
7.0.115-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet6<6.0.126-0ubuntu1~22.04.1
6.0.126-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/dotnet7<7.0.115-0ubuntu1~22.04.1
7.0.115-0ubuntu1~22.04.1
Ubuntu Ubuntu=22.04
Event History
Jan 11, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6578-1?
The severity of USN-6578-1 is high due to its potential to allow attackers to bypass authentication mechanisms.
2
How do I fix USN-6578-1?
To fix USN-6578-1, update to the recommended package versions provided in the security notice.
3
What software is affected by USN-6578-1?
USN-6578-1 affects multiple packages in the .NET runtime ecosystem on Ubuntu 23.10.
4
What vulnerabilities are addressed in USN-6578-1?
USN-6578-1 addresses issues related to improper validation of X.509 certificates with malformed signatures.
5
Is there a workaround for USN-6578-1?
There are no recommended workarounds for USN-6578-1; mitigation involves applying the security updates.