Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SDK (Microsoft.NET.Build.Containers). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering vulnerability exists in the .NET SDK (.NET 8, .NET 9, and .NET 10) container image build process which could allow a local attacker to inject resources that could be incorporated into container images built by other users on the same machine. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: High - Score: 7.0 - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-59 (Improper Link Resolution Before File Access ('Link Following')) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-35390: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists when some dotnet commands are used in directories with weaker permissions which can result in remote code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/266 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0.1xx SDK 7.0.109 or earlier. Any .NET 7.0.3xx SDK 7.0.306 or earlier. Any .NET 6.0.1xx SDK 6.0.120 or earlier. Any .NET 6.0.3xx SDK 6.0.315 or earlier. Any .NET 6.0.4xx SDK 6.0.412 or earlier.…
Recommended action: Upgrade to 7.0.307 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.