—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA256<\/p>\n
=====================================================================
\nRed Hat Security Advisory<\/p>\n
Synopsis: Important: .NET 7.0 security, bug fix, and enhancement update
\nAdvisory ID: RHSA-2023:4058-01
\nProduct: Red Hat Enterprise Linux
\nAdvisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2023:4058
\nIssue date: 2023-07-13
\nCVE Names: CVE-2023-33170
\n=====================================================================<\/p>\n
1. Summary:<\/p>\n
An update for .NET 7.0 is now available for Red Hat Enterprise Linux 8.<\/p>\n
Red Hat Product Security has rated this update as having a security impact
\nof Important. A Common Vulnerability Scoring System (CVSS) base score,
\nwhich gives a detailed severity rating, is available for each vulnerability
\nfrom the CVE link(s) in the References section.<\/p>\n
2. Relevant releases\/architectures:<\/p>\n
Red Hat Enterprise Linux AppStream (v. 8) – aarch64, ppc64le, s390x, x86_64
\nRed Hat Enterprise Linux CRB (v. 8) – aarch64, ppc64le, s390x, x86_64<\/p>\n
3. Description:<\/p>\n
.NET is a managed-software framework. It implements a subset of the .NET
\nframework APIs and several new APIs, and it includes a CLR implementation.<\/p>\n
The following packages have been upgraded to a later upstream version:
\ndotnet7.0 (SDK 7.0.109, Runtime 7.0.9). (BZ#2219633)<\/p>\n
Security Fix(es):<\/p>\n
* dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync
\nmethod (CVE-2023-33170)<\/p>\n
For more details about the security issue(s), including the impact, a CVSS
\nscore, acknowledgments, and other related information, refer to the CVE
\npage(s) listed in the References section.<\/p>\n
4. Solution:<\/p>\n
For details on how to apply this update, which includes the changes
\ndescribed in this advisory, refer to:<\/p>\n
https:\/\/access.redhat.com\/articles\/11258<\/p>\n
5. Bugs fixed (https:\/\/bugzilla.redhat.com\/):<\/p>\n
2221854 – CVE-2023-33170 dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method<\/p>\n
6. Package List:<\/p>\n
Red Hat Enterprise Linux AppStream (v. 8):<\/p>\n
Source:
\ndotnet7.0-7.0.109-1.el8_8.src.rpm<\/p>\n
aarch64:
\naspnetcore-runtime-7.0-7.0.9-1.el8_8.aarch64.rpm
\naspnetcore-targeting-pack-7.0-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-7.0.109-1.el8_8.aarch64.rpm
\ndotnet-apphost-pack-7.0-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-host-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-hostfxr-7.0-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-runtime-7.0-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-sdk-7.0-7.0.109-1.el8_8.aarch64.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.aarch64.rpm
\ndotnet-targeting-pack-7.0-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-templates-7.0-7.0.109-1.el8_8.aarch64.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.aarch64.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.aarch64.rpm
\nnetstandard-targeting-pack-2.1-7.0.109-1.el8_8.aarch64.rpm<\/p>\n
ppc64le:
\naspnetcore-runtime-7.0-7.0.9-1.el8_8.ppc64le.rpm
\naspnetcore-targeting-pack-7.0-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet-apphost-pack-7.0-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-host-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-hostfxr-7.0-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-runtime-7.0-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-sdk-7.0-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet-targeting-pack-7.0-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-templates-7.0-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.ppc64le.rpm
\nnetstandard-targeting-pack-2.1-7.0.109-1.el8_8.ppc64le.rpm<\/p>\n
s390x:
\naspnetcore-runtime-7.0-7.0.9-1.el8_8.s390x.rpm
\naspnetcore-targeting-pack-7.0-7.0.9-1.el8_8.s390x.rpm
\ndotnet-7.0.109-1.el8_8.s390x.rpm
\ndotnet-apphost-pack-7.0-7.0.9-1.el8_8.s390x.rpm
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-host-7.0.9-1.el8_8.s390x.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-hostfxr-7.0-7.0.9-1.el8_8.s390x.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-runtime-7.0-7.0.9-1.el8_8.s390x.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-sdk-7.0-7.0.109-1.el8_8.s390x.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.s390x.rpm
\ndotnet-targeting-pack-7.0-7.0.9-1.el8_8.s390x.rpm
\ndotnet-templates-7.0-7.0.109-1.el8_8.s390x.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.s390x.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.s390x.rpm
\nnetstandard-targeting-pack-2.1-7.0.109-1.el8_8.s390x.rpm<\/p>\n
x86_64:
\naspnetcore-runtime-7.0-7.0.9-1.el8_8.x86_64.rpm
\naspnetcore-targeting-pack-7.0-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-7.0.109-1.el8_8.x86_64.rpm
\ndotnet-apphost-pack-7.0-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-host-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-hostfxr-7.0-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-runtime-7.0-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-sdk-7.0-7.0.109-1.el8_8.x86_64.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.x86_64.rpm
\ndotnet-targeting-pack-7.0-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-templates-7.0-7.0.109-1.el8_8.x86_64.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.x86_64.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.x86_64.rpm
\nnetstandard-targeting-pack-2.1-7.0.109-1.el8_8.x86_64.rpm<\/p>\n
Red Hat Enterprise Linux CRB (v. 8):<\/p>\n
aarch64:
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.aarch64.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.aarch64.rpm
\ndotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el8_8.aarch64.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.aarch64.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.aarch64.rpm<\/p>\n
ppc64le:
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.ppc64le.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.ppc64le.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.ppc64le.rpm<\/p>\n
s390x:
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.s390x.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.s390x.rpm
\ndotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el8_8.s390x.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.s390x.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.s390x.rpm<\/p>\n
x86_64:
\ndotnet-apphost-pack-7.0-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-host-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-hostfxr-7.0-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-runtime-7.0-debuginfo-7.0.9-1.el8_8.x86_64.rpm
\ndotnet-sdk-7.0-debuginfo-7.0.109-1.el8_8.x86_64.rpm
\ndotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el8_8.x86_64.rpm
\ndotnet7.0-debuginfo-7.0.109-1.el8_8.x86_64.rpm
\ndotnet7.0-debugsource-7.0.109-1.el8_8.x86_64.rpm<\/p>\n
These packages are GPG signed by Red Hat for security. Our key and
\ndetails on how to verify the signature are available from
\nhttps:\/\/access.redhat.com\/security\/team\/key\/<\/p>\n
7. References:<\/p>\n
https:\/\/access.redhat.com\/security\/cve\/CVE-2023-33170
\nhttps:\/\/access.redhat.com\/security\/updates\/classification\/#important<\/p>\n
8. Contact:<\/p>\n
The Red Hat security contact is <secalert@redhat.com>. More contact
\ndetails at https:\/\/access.redhat.com\/security\/team\/contact\/<\/p>\n
Copyright 2023 Red Hat, Inc.
\n—–BEGIN PGP SIGNATURE—–
\nVersion: GnuPG v1<\/p>\n
iQIcBAEBCAAGBQJkr\/6TAAoJENzjgjWX9erErocP\/ixY1zXl9SDyKwMw0bBEhctt
\nj\/6F0UV\/bSYSMx1cNIiLgHd2Ikw2tlRq7ABLtiGNRM\/U8DIGHLMaUFAlhoGf151V
\nzRbUIAwHDG6tY1XmhFbKFAjyI0LjFUAt8cgz1kzrgF3tQr4NJm7+jsps8NtLIFt2
\nfJ9T7sA6ZHfEdzPO\/nctACK1IGb9g4YTUW5sIWi7QFaTzsyi0FHmEu5pYQcXi8ew
\nJn8Zx8ODjhxEdXiVkNeIdWFNr7b\/rLhI+PpyvDbX78JTGfDW+f40h6C6+nh73YsF
\nqmre\/qWnX5Df0MIKYLHvhhyJroG0TdO\/J4QLM67Y6lPV4q\/XldV9lv\/QD8fz9RX4
\n4u7K2GzZhvC2DynNIn222B8P6e0usyYgUWWU4m7uSAZPSuEmOhFwC5BYJ\/zDXMSL
\n7X\/pNGP2F0X2QemiFeEmdRKYV+5wE\/jduqWXEewtLkMC7kd\/RXsIz48\/KBlM6mA0
\nhQlB6liU4sBor1p9KOO96aoDY3xe65O2wAmboek59GB3u86DJJZiOrmXKWWkD4vt
\n3BG\/lNRjpZn2Wo7fIQWsOXU3hVTEbwpq0PBxEZIiOzsHsLW2pZo5cR2\/ZsqTz+8j
\nvnVZMUkGXZFHbTxQAvMHnXswuS0DTP8rDK\/B6vhq25cllM545Y\/FxUg+kG6M+DGQ
\ncBPA\/r\/Xsfj02cnYa+Zc
\n=4ax+
\n—–END PGP SIGNATURE—–
\n—
\nRHSA-announce mailing list
\nRHSA-announce@redhat.com
\nhttps:\/\/listman.redhat.com\/mailman\/listinfo\/rhsa-announce<\/p>\n","protected":false},"excerpt":{"rendered":"
—–BEGIN PGP SIGNED MESSAGE—– Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: .NET 7.0 security, bug fix, and enhancement update Advisory ID: RHSA-2023:4058-01 Product: Red Hat Enterprise Linux Advisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2023:4058 Issue date: 2023-07-13 CVE Names: CVE-2023-33170 ===================================================================== 1. Summary: An update for .NET 7.0 is now available for Red Hat Enterprise Linux 8. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-44928","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/44928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=44928"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/44928\/revisions"}],"predecessor-version":[{"id":45085,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/44928\/revisions\/45085"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=44928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=44928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=44928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}