Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Microsoft Security Advisory CVE-2024-43498 | .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a .NET vulnerable webapp or loading a specially crafted file into a vulnerable application. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/334 <a name="mitigation-factors"</aMitigation factors Applications that do not use the NrbfDecoder component are not affected by this vulnerability. By default, .NET console apps and web apps do not reference this component. <a name="affected-software"</aAffected software Any .NET 9.0 application running on .NET 9.0.0.RC.2 or…
Recommended action: Upgrade to 9.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-43499 | .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The NrbfDecoder component in .NET 9 contains a denial of service vulnerability due to incorrect input validation. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/333 <a name="mitigation-factors"</aMitigation factors Applications that do not use the NrbfDecoder component are not affected by this vulnerability. By default, .NET console apps and web apps do not reference this component. <a name="affected-software"</aAffected software Any .NET 9.0 application running on .NET 9.0.0.RC.2 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft…
Recommended action: Upgrade to 9.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.