Headline
RHSA-2022:5046: Red Hat Security Advisory: .NET 6.0 security and bugfix update
An update for .NET 6.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-30184: dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-06-15
Updated:
2022-06-15
RHSA-2022:5046 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: .NET 6.0 security and bugfix update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for .NET 6.0 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.106 and .NET Runtime 6.0.6.
Security Fix(es):
- dotnet: NuGet Credential leak due to loss of control of third party symbol server domain (CVE-2022-30184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 8 x86_64
- Red Hat Enterprise Linux Server - TUS 8.6 x86_64
Fixes
- BZ - 2096963 - CVE-2022-30184 dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
Red Hat Enterprise Linux for x86_64 8
SRPM
dotnet6.0-6.0.106-1.el8_6.src.rpm
SHA-256: 401257b3f0d88bcee51a269c2f4edf0b1d7619df77976d4012a971198d75a2ca
x86_64
aspnetcore-runtime-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: f50ad581598983e1ff79e9893b49ef5f497acadad8a3ea0590c389aa1ca1a926
aspnetcore-targeting-pack-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: c08a8863aa3a52a34867e9bc11818df5ce3190b848a9932490fd86112b5f9665
dotnet-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 5df3d52d675cb9ed6cfb9c21df30e54ad3dc95f9e33c3109153d5edb72e08cd7
dotnet-apphost-pack-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 2616426078896d8b5cb53b8ac458108174d910b384febda69fe3fd1cbcf0fe56
dotnet-host-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 7e4337ebee83056ceb107c33d88d8379fa8d10ab32c6cd97cd6173c8aed2689b
dotnet-hostfxr-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 05e89ad33457ab58a9b001031a37b165da190d942e0e087ce8c12c966f58425f
dotnet-runtime-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: a1bcb3c0b7bb271f3d7027d978e324f30e22ccafd31ea8e51549f7ef8648be9e
dotnet-sdk-6.0-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 65ae91e2a2051e8ecbb424da4d6979a5bb576ec35fe5656b80a092b23d5f6d8c
dotnet-targeting-pack-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 876559e2d214891f1f61f070e3765256ae2290aba144512ab04ce951daa717ba
dotnet-templates-6.0-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 9eec2d927e43a9b228fd4ebbed427464b62dba6d3eb9c2fb115e70f621754454
netstandard-targeting-pack-2.1-6.0.106-1.el8_6.x86_64.rpm
SHA-256: e757b64b5656b6ca81d2f58a4e5b3fed84ab0f36e3635dc9af02257aa51f9af0
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6
SRPM
dotnet6.0-6.0.106-1.el8_6.src.rpm
SHA-256: 401257b3f0d88bcee51a269c2f4edf0b1d7619df77976d4012a971198d75a2ca
x86_64
Red Hat Enterprise Linux Server - TUS 8.6
SRPM
dotnet6.0-6.0.106-1.el8_6.src.rpm
SHA-256: 401257b3f0d88bcee51a269c2f4edf0b1d7619df77976d4012a971198d75a2ca
x86_64
aspnetcore-runtime-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: f50ad581598983e1ff79e9893b49ef5f497acadad8a3ea0590c389aa1ca1a926
aspnetcore-targeting-pack-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: c08a8863aa3a52a34867e9bc11818df5ce3190b848a9932490fd86112b5f9665
dotnet-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 5df3d52d675cb9ed6cfb9c21df30e54ad3dc95f9e33c3109153d5edb72e08cd7
dotnet-apphost-pack-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 2616426078896d8b5cb53b8ac458108174d910b384febda69fe3fd1cbcf0fe56
dotnet-apphost-pack-6.0-debuginfo-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 1cc1624c9df2a4676ab76bbeaf543a10cacb9a35d2829ed60d009a42276d7857
dotnet-host-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 7e4337ebee83056ceb107c33d88d8379fa8d10ab32c6cd97cd6173c8aed2689b
dotnet-host-debuginfo-6.0.6-1.el8_6.x86_64.rpm
SHA-256: e6feab002ec3907aa505b8cb2bea9ad8b609498cf8caa4a9f66cff95f53e732e
dotnet-hostfxr-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 05e89ad33457ab58a9b001031a37b165da190d942e0e087ce8c12c966f58425f
dotnet-hostfxr-6.0-debuginfo-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 3445d0af7b81fd82310e50c1c76a7379218dd7370503090790dc4ad935eb56e1
dotnet-runtime-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: a1bcb3c0b7bb271f3d7027d978e324f30e22ccafd31ea8e51549f7ef8648be9e
dotnet-runtime-6.0-debuginfo-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 150927cd4048ff03f1b8a761a63e12c702725a586691868a9646ecb5e9f6e45c
dotnet-sdk-6.0-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 65ae91e2a2051e8ecbb424da4d6979a5bb576ec35fe5656b80a092b23d5f6d8c
dotnet-sdk-6.0-debuginfo-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 4a593f6cb017a6488683a5e559273da28f8aa1a8571b98de3551fe764340a4e3
dotnet-targeting-pack-6.0-6.0.6-1.el8_6.x86_64.rpm
SHA-256: 876559e2d214891f1f61f070e3765256ae2290aba144512ab04ce951daa717ba
dotnet-templates-6.0-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 9eec2d927e43a9b228fd4ebbed427464b62dba6d3eb9c2fb115e70f621754454
dotnet6.0-debuginfo-6.0.106-1.el8_6.x86_64.rpm
SHA-256: 3300e35f8b5d869ffcd9b1ef004545044cc84d3ca86cc1b876f3a2b965b350e6
dotnet6.0-debugsource-6.0.106-1.el8_6.x86_64.rpm
SHA-256: dcf7dda1af415eef714aa8710c846f76889d1964f5c5d51e895396301f16692a
netstandard-targeting-pack-2.1-6.0.106-1.el8_6.x86_64.rpm
SHA-256: e757b64b5656b6ca81d2f58a4e5b3fed84ab0f36e3635dc9af02257aa51f9af0
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Red Hat Security Advisory 2022-5050-01 - .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.106 and .NET Runtime 6.0.6. Issues addressed include a password leak vulnerability.
Red Hat Security Advisory 2022-5062-01 - .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 3.1.420 and .NET Runtime 3.1.26. Issues addressed include a password leak vulnerability.
Red Hat Security Advisory 2022-5061-01 - .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 3.1.420 and .NET Runtime 3.1.26. Issues addressed include a password leak vulnerability.
Red Hat Security Advisory 2022-5046-01 - .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.106 and .NET Runtime 6.0.6. Issues addressed include a password leak vulnerability.
.NET and Visual Studio Information Disclosure Vulnerability.
An update for .NET 6.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-30184: dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-30184: dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-30184: dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
### Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET Core 3.1, NuGet (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET 6.0, .NET Core 3.1, and NuGet (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0) where a nuget.org api key could leak due to an incorrect comparison with a server url. ### Affected software #### NuGet & NuGet Packages - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat 6.2.0 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat 6.0.1 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat 5.11.1 version or earlier. - Any NuG...