Red Hat Product Errata RHSA-2024:0157 - Security Advisory
Issued:
2024-01-10
Updated:
2024-01-10

RHSA-2024:0157 - Security Advisory

Synopsis

Important: .NET 7.0 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for .NET 7.0 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15.

Security Fix(es):

  • dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
  • dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
  • dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 2255384 - CVE-2024-0056 dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS)
  • BZ - 2255386 - CVE-2024-0057 dotnet: X509 Certificates - Validation Bypass across Azure
  • BZ - 2257566 - CVE-2024-21319 dotnet: .NET Denial of Service Vulnerability

Red Hat Enterprise Linux for x86_64 8

SRPM
dotnet7.0-7.0.115-1.el8_9.src.rpm SHA-256: 31d76ee92a0d40f7cedd3847169829b94138b0508cc9baf01f61fce8fb716b02
x86_64
aspnetcore-runtime-7.0-7.0.15-1.el8_9.x86_64.rpm SHA-256: 3b6d2ed3ae4ecec8bf20f3fb17b7c25d3f6b148a03712c2baf9923a23a4d637d
aspnetcore-targeting-pack-7.0-7.0.15-1.el8_9.x86_64.rpm SHA-256: 5eecce772372a191d502f22918b6823400d6dc491e0f61d439288485db860f1e
dotnet-apphost-pack-7.0-7.0.15-1.el8_9.x86_64.rpm SHA-256: 168b294da2a1e5688ce17dfc64140e711b5858fe80a17f1de9bb7eb019dfe259
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.x86_64.rpm SHA-256: 11056933c0fe21768a6ae50f594a999162207e4f9e6a80e8f37866b8f67934cc
dotnet-hostfxr-7.0-7.0.15-1.el8_9.x86_64.rpm SHA-256: 6dec0b218ba83d202134715e4fdaa66441f034a57769c73e02aa7f537233851b
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.x86_64.rpm SHA-256: 055af37ae63e0f24e00e912a1ed2e0cee048eb2906c377e4e45e7b88e2b84a24
dotnet-runtime-7.0-7.0.15-1.el8_9.x86_64.rpm SHA-256: 5b3384d6880b15c009036d50b1efaa0750a48d1557cb99559cf4394744e0f8b5
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.x86_64.rpm SHA-256: 8f73408c769070719f448600dca9992bc0abf2a7931ab9449e2ea3bac583d441
dotnet-sdk-7.0-7.0.115-1.el8_9.x86_64.rpm SHA-256: c466b60f7eeab5f14a2032f6ed2c77481c510ba5f8ee3c6add8f7f6f05ebe70a
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.x86_64.rpm SHA-256: 780680719b5d44630436ac75d0ffc75441bf47a6c96d4440639c594451b3df2d
dotnet-targeting-pack-7.0-7.0.15-1.el8_9.x86_64.rpm SHA-256: bc776c1a685e34ebde364df1a8177603ee431c5d38ce4b1d02de500b2d67c5eb
dotnet-templates-7.0-7.0.115-1.el8_9.x86_64.rpm SHA-256: 4ed32e2aebfca6472094e649d9b767e000a322482041ad8f66cd43c73063abcc
dotnet7.0-debuginfo-7.0.115-1.el8_9.x86_64.rpm SHA-256: 35127c83451abe3220a32cf9538bef429785ec2d98fda6e4f16ce3ceb17523d3
dotnet7.0-debugsource-7.0.115-1.el8_9.x86_64.rpm SHA-256: 7ee890f8d31c499da968033029985d7ab91b8409a779dd0cc1f39a9995c770ad

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
dotnet7.0-7.0.115-1.el8_9.src.rpm SHA-256: 31d76ee92a0d40f7cedd3847169829b94138b0508cc9baf01f61fce8fb716b02
s390x
aspnetcore-runtime-7.0-7.0.15-1.el8_9.s390x.rpm SHA-256: fb6b23e5e3598c0b30ad8e8d82ba5a43a206cb74b06e0f4d95924faea68d689b
aspnetcore-targeting-pack-7.0-7.0.15-1.el8_9.s390x.rpm SHA-256: 9a765150ee732dcbc05dc5a30715d92beb7aaa3be4d97234baa1d251a197934d
dotnet-apphost-pack-7.0-7.0.15-1.el8_9.s390x.rpm SHA-256: 1cb2a4aca303be36ea6b45fccc707fae7bf43d104b3fecbc873207005069fd5b
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.s390x.rpm SHA-256: 1056fab18ec16fca3b1fb602652aa866356c00e0f69cb7f277f480c5918369e2
dotnet-hostfxr-7.0-7.0.15-1.el8_9.s390x.rpm SHA-256: d15fa2b1e70d9f552c578375159b58a9d8885822a41fa51b765c4433e580d82d
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.s390x.rpm SHA-256: 091168047d8a477e96c3e0a3396a0abcca288690682b8865a55030895d2ac8bd
dotnet-runtime-7.0-7.0.15-1.el8_9.s390x.rpm SHA-256: 028b4368d956b4133338a5aa55de095260e32ef4ecf874c339ea774008e5394d
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.s390x.rpm SHA-256: afaa671c57454d96e3933b6cdd793e37119658d1495b149cdf94012d1c4949e7
dotnet-sdk-7.0-7.0.115-1.el8_9.s390x.rpm SHA-256: cc028a29c87b1e56b1397ca3a51ba3966b5f9e3b64f141dd342db5778ed65202
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.s390x.rpm SHA-256: 15647bf8335ddb70ce77110b1a031702cc7142e751c869412103fb59167f036b
dotnet-targeting-pack-7.0-7.0.15-1.el8_9.s390x.rpm SHA-256: 3188aca1377d8514149084306b44a972488958012e1d04bf2330507e9393f5ec
dotnet-templates-7.0-7.0.115-1.el8_9.s390x.rpm SHA-256: ea61a35df775c10555c14447633d187cfcca523433e3de225937daab1be1e4d0
dotnet7.0-debuginfo-7.0.115-1.el8_9.s390x.rpm SHA-256: d4ffdfe85c3a5a2faa4b88a8c3d94e7dfd59edb968855ec72e8d5ad65f81b918
dotnet7.0-debugsource-7.0.115-1.el8_9.s390x.rpm SHA-256: 61f46c94efc12bbac2f3b35942eafc5c08ca9b422e9b14b8a8485d06b0ff825b

Red Hat Enterprise Linux for Power, little endian 8

SRPM
dotnet7.0-7.0.115-1.el8_9.src.rpm SHA-256: 31d76ee92a0d40f7cedd3847169829b94138b0508cc9baf01f61fce8fb716b02
ppc64le
aspnetcore-runtime-7.0-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 47ba294b0ae57c3ff2cf30fabce847412828a26995fbf8c560839017a8dfd1ca
aspnetcore-targeting-pack-7.0-7.0.15-1.el8_9.ppc64le.rpm SHA-256: aefa5ca3680d498b6f9fb2b3dbfcd759f8b6737e3ffd5f111c1270096020846e
dotnet-apphost-pack-7.0-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 9c710979391bfb3e0e648094f15def383c760ae651e2006d1c6b9b0c6a497fc2
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 1d7b5bfb267e2e67a15ff573cd159d2820225ff1b7f438e6de1ec2461ff82f07
dotnet-hostfxr-7.0-7.0.15-1.el8_9.ppc64le.rpm SHA-256: da2eb38af0560efa39d57ff27cec5e2275b5e136a206b4d277ca4ff910ebac1e
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.ppc64le.rpm SHA-256: cef8dcb3406fc835505e59802d1c5b7079034e40a1381dae5ca1ccc90e59cdcc
dotnet-runtime-7.0-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 3fec3be336233f6c03fa10610aed51b197cf1e551c065b98b6dfaa8fb62d426d
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 0cb1e2d9075cb367fd8b7117d39555a2f64a90577e7aa5c754e7e8e0c42a8a88
dotnet-sdk-7.0-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 9312ba2ad2dfddb9daff5dfdf98a354f2bfeac683c0cbc682e071b045e54bf51
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 5cef48827850d4131f49af108caaf7b149775d65ba9bbdd54e9fcddef9020ca5
dotnet-targeting-pack-7.0-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 5ddb64d5a72bc70c2229940ba8915fc7621037662d9e99b3bb618a1635848fde
dotnet-templates-7.0-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 38ff963be524442f0950dcdee67a91be8a8e1a7301414d23ea9bb5bd89be3f41
dotnet7.0-debuginfo-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 22f282c33667d936752b100fdf5d395f8f4b51746dba6ebe49aef572473b33a6
dotnet7.0-debugsource-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 8c7e6a684c8c898167362395e9b4319838768bd878a9a02a1226f76095f47604

Red Hat Enterprise Linux for ARM 64 8

SRPM
dotnet7.0-7.0.115-1.el8_9.src.rpm SHA-256: 31d76ee92a0d40f7cedd3847169829b94138b0508cc9baf01f61fce8fb716b02
aarch64
aspnetcore-runtime-7.0-7.0.15-1.el8_9.aarch64.rpm SHA-256: f6bad0e141276c3c5fb37e48a1e42a63b92d04ad027d76ad342d81500aa5379b
aspnetcore-targeting-pack-7.0-7.0.15-1.el8_9.aarch64.rpm SHA-256: 5497010d20376ea6ff9206495ee6248f0a08cb38ecd8432bac006483638e233f
dotnet-apphost-pack-7.0-7.0.15-1.el8_9.aarch64.rpm SHA-256: fe952c0be9b42dde6eea8cf123f60a221b8ce3b26c3f5bd21ae4595cbfdc4414
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.aarch64.rpm SHA-256: 3f10bf0d97acf9f5ef27e33c8f04a9c4cc97e8fcf9a1af574ba83caf4c64b629
dotnet-hostfxr-7.0-7.0.15-1.el8_9.aarch64.rpm SHA-256: 02947bd5f35eb3de522b391bf0fdbaff67546cc7aaf56cdd6a6de4f32bf70048
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.aarch64.rpm SHA-256: ba4a5203f36d795ab7b5e6bfde5be05a413d3cfa6510a9957233375399b27ef1
dotnet-runtime-7.0-7.0.15-1.el8_9.aarch64.rpm SHA-256: dc1d40426fb7e031bfc89f6b26de8031e5aec042b76f5b1893b605d9a828f46a
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.aarch64.rpm SHA-256: ecda35a99d71bcc2da215fd5228ef836d43fdfeb59796c6af4da336a2bfc7c3c
dotnet-sdk-7.0-7.0.115-1.el8_9.aarch64.rpm SHA-256: fe933b5c8273fd32b2e36360be3502f3c3ef62ba5546f3d73bc48011c63f41c4
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.aarch64.rpm SHA-256: b086cb1425c2f7a0950a6daf488c54ad114efc841acf75ac458e90744a7ffde8
dotnet-targeting-pack-7.0-7.0.15-1.el8_9.aarch64.rpm SHA-256: 1f61038eea94c2b240019a9f93267f17ce1bf19c04daff745c4571302ff33ff6
dotnet-templates-7.0-7.0.115-1.el8_9.aarch64.rpm SHA-256: c32948a5f7d24cea775eacb630b754c3b39c35854e5968cf147a702d4e73ce04
dotnet7.0-debuginfo-7.0.115-1.el8_9.aarch64.rpm SHA-256: 69d21663a5838325126bbd33de9419c8dbfd28f6d7a291aad78fb7f5b6bc8a7d
dotnet7.0-debugsource-7.0.115-1.el8_9.aarch64.rpm SHA-256: deb36f058ad70c969a367b2d23828a2cd91f33d6da39fbf9d54dad9ce6aa7037

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.x86_64.rpm SHA-256: 11056933c0fe21768a6ae50f594a999162207e4f9e6a80e8f37866b8f67934cc
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.x86_64.rpm SHA-256: 055af37ae63e0f24e00e912a1ed2e0cee048eb2906c377e4e45e7b88e2b84a24
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.x86_64.rpm SHA-256: 8f73408c769070719f448600dca9992bc0abf2a7931ab9449e2ea3bac583d441
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.x86_64.rpm SHA-256: 780680719b5d44630436ac75d0ffc75441bf47a6c96d4440639c594451b3df2d
dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el8_9.x86_64.rpm SHA-256: cbc80752de536b1b42409eba8445ddc182f8172e9a0ca6d573ecaace53f6ea5d
dotnet7.0-debuginfo-7.0.115-1.el8_9.x86_64.rpm SHA-256: 35127c83451abe3220a32cf9538bef429785ec2d98fda6e4f16ce3ceb17523d3
dotnet7.0-debugsource-7.0.115-1.el8_9.x86_64.rpm SHA-256: 7ee890f8d31c499da968033029985d7ab91b8409a779dd0cc1f39a9995c770ad

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 1d7b5bfb267e2e67a15ff573cd159d2820225ff1b7f438e6de1ec2461ff82f07
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.ppc64le.rpm SHA-256: cef8dcb3406fc835505e59802d1c5b7079034e40a1381dae5ca1ccc90e59cdcc
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.ppc64le.rpm SHA-256: 0cb1e2d9075cb367fd8b7117d39555a2f64a90577e7aa5c754e7e8e0c42a8a88
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 5cef48827850d4131f49af108caaf7b149775d65ba9bbdd54e9fcddef9020ca5
dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el8_9.ppc64le.rpm SHA-256: efd7213574fce825a6b0c6a844a3d033a47ff87a7c2ac8f7dd4aa234e373ef9f
dotnet7.0-debuginfo-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 22f282c33667d936752b100fdf5d395f8f4b51746dba6ebe49aef572473b33a6
dotnet7.0-debugsource-7.0.115-1.el8_9.ppc64le.rpm SHA-256: 8c7e6a684c8c898167362395e9b4319838768bd878a9a02a1226f76095f47604

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.aarch64.rpm SHA-256: 3f10bf0d97acf9f5ef27e33c8f04a9c4cc97e8fcf9a1af574ba83caf4c64b629
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.aarch64.rpm SHA-256: ba4a5203f36d795ab7b5e6bfde5be05a413d3cfa6510a9957233375399b27ef1
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.aarch64.rpm SHA-256: ecda35a99d71bcc2da215fd5228ef836d43fdfeb59796c6af4da336a2bfc7c3c
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.aarch64.rpm SHA-256: b086cb1425c2f7a0950a6daf488c54ad114efc841acf75ac458e90744a7ffde8
dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el8_9.aarch64.rpm SHA-256: 69a15d1426db571cb29c46f3d2fe767d37c9024ddf18486958b446833543b17a
dotnet7.0-debuginfo-7.0.115-1.el8_9.aarch64.rpm SHA-256: 69d21663a5838325126bbd33de9419c8dbfd28f6d7a291aad78fb7f5b6bc8a7d
dotnet7.0-debugsource-7.0.115-1.el8_9.aarch64.rpm SHA-256: deb36f058ad70c969a367b2d23828a2cd91f33d6da39fbf9d54dad9ce6aa7037

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
dotnet-apphost-pack-7.0-debuginfo-7.0.15-1.el8_9.s390x.rpm SHA-256: 1056fab18ec16fca3b1fb602652aa866356c00e0f69cb7f277f480c5918369e2
dotnet-hostfxr-7.0-debuginfo-7.0.15-1.el8_9.s390x.rpm SHA-256: 091168047d8a477e96c3e0a3396a0abcca288690682b8865a55030895d2ac8bd
dotnet-runtime-7.0-debuginfo-7.0.15-1.el8_9.s390x.rpm SHA-256: afaa671c57454d96e3933b6cdd793e37119658d1495b149cdf94012d1c4949e7
dotnet-sdk-7.0-debuginfo-7.0.115-1.el8_9.s390x.rpm SHA-256: 15647bf8335ddb70ce77110b1a031702cc7142e751c869412103fb59167f036b
dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el8_9.s390x.rpm SHA-256: c2afeb4e70bba22353919c08aaa25a1daa5f69251530aec419ff1348de4395e1
dotnet7.0-debuginfo-7.0.115-1.el8_9.s390x.rpm SHA-256: d4ffdfe85c3a5a2faa4b88a8c3d94e7dfd59edb968855ec72e8d5ad65f81b918
dotnet7.0-debugsource-7.0.115-1.el8_9.s390x.rpm SHA-256: 61f46c94efc12bbac2f3b35942eafc5c08ca9b422e9b14b8a8485d06b0ff825b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.