SB2024020255 - Anolis OS update for dotnet6.0

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Security features bypass (CVE-ID: CVE-2024-0056)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to security features bypass in Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider. A remote attacker can evade the encryption used in a TLS connection.

2) Security features bypass (CVE-ID: CVE-2024-0057)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to security features bypass in NET, .NET Framework and Visual Studio. A remote attacker can present an arbitrary untrusted certificate with malformed signatures and bypass the security feature.

3) Input validation error (CVE-ID: CVE-2024-21319)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Microsoft Identity. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

4) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2023-46233)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of a weak PBKDF2 algorithm. A remote attacker can gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2024:0038