https://reddit.com/r/sysadmin/comments/1xgj5cj/outofband_net_patches_landed_oct_25_for_the/: Out-of-band .NET patches landed Oct 25 for the Brotli CVE — fixed builds are 8.0.33 / 9.0.22 / 10.0.14, and PowerShell got fixes too
Affected Software
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Internet-facing ASP.NET Core applications should be prioritized when they accept Brotli-compressed data from untrusted sources. Internal applications that never enable the affected decompression paths have a lower-priority case.
What conditions are required for exploitation?
An application must decompress Brotli data that it does not control. The identified paths are ASP.NET Core request decompression, HttpClient automatic decompression, and use of the System.IO.Compression Brotli APIs.
Are systems affected in their default configuration?
Neither affected decompression path is enabled by default. Systems that have not enabled these paths are not described as exposed through those mechanisms.
How can I determine whether a .NET deployment still needs attention?
Shared-runtime deployments below .NET 8.0.33, 9.0.22, or 10.0.14 are still exposed if they use an affected Brotli decompression path. .NET Framework is not affected.
Will updating the shared .NET runtime fix every application on the host?
No. Updating the shared runtime does not remediate self-contained applications, because they carry their own runtime.