In short
- CVE-2022-38013 is a HIGH (CVSS 7.5) vulnerability affecting Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm.
- Chance of exploitation in the next 30 days (EPSS): 4.0%, higher than 90.6% of all vulnerabilities.
- Fix: update to 3.1.29, 6.0.9 or later.
| Package | Affected versions | Patched versions |
|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.linux-arm64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm NuGet | ≥ 5.0.0, < 6.0.9
| 6.0.9
|
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.linux-x64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.osx-arm64 NuGet | ≥ 5.0.0, < 6.0.9
| 6.0.9
|
| Microsoft.AspNetCore.App.Runtime.osx-x64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.win-arm NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.win-x64 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| Microsoft.AspNetCore.App.Runtime.win-x86 NuGet | ≥ 3.1.0, < 3.1.29≥ 5.0.0, < 6.0.9
| 3.1.296.0.9
|
| .net | = 6.0.0
| No fix yet |
| .net core | = 3.1
| No fix yet |
| visual studio 2019 | = 16.11= 16.9
| No fix yet |
| visual studio 2022 | = 17.0= 17.2= 17.3
| No fix yet |
Description
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in ASP.NET Core 3.1 and .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding.
<a name="affected-software"></a>Affected software
- Any .NET 6.0 application running on .NET 6.0.8 or earlier.
- Any ASP.NET Core 3.1 application running on .NET Core 3.1.28 or earlier.
If your application uses the following package versions, ensure you update to the latest version of .NET.
<a name="ASP.NET Core 3.1"></a>.NET Core 3.1
More vulnerabilities in Microsoft.AspNetCore.App.Runtime.linux-arm
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free