Input validation error in Microsoft .NET Core - CVE-2023-21538

Vulnerability identifier: #VU71039

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-21538

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in .NET. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Microsoft .NET Core
Amazon Linux AMI
Oracle Linux
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
Fedora
aspnetcore-runtime-6.0 (Ubuntu package)
dotnet-host (Ubuntu package)
dotnet-hostfxr-6.0 (Ubuntu package)
dotnet6 (Ubuntu package)
dotnet-sdk-6.0 (Ubuntu package)
dotnet-runtime-6.0 (Ubuntu package)
rh-dotnet60-dotnet (Red Hat package)
dotnet6.0 (Red Hat package)
dotnet6.0
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Microsoft .NET Core - update to 6.0.13
aspnetcore-runtime-6.0 (Ubuntu package) - addressed in versions 6.0.113-0ubuntu1~22.04.1, 6.0.113-0ubuntu1~22.10.1
dotnet-host (Ubuntu package) - addressed in versions 6.0.113-0ubuntu1~22.04.1, 6.0.113-0ubuntu1~22.10.1
dotnet-hostfxr-6.0 (Ubuntu package) - addressed in versions 6.0.113-0ubuntu1~22.04.1, 6.0.113-0ubuntu1~22.10.1
dotnet6 (Ubuntu package) - addressed in versions 6.0.113-0ubuntu1~22.04.1, 6.0.113-0ubuntu1~22.10.1
dotnet-sdk-6.0 (Ubuntu package) - addressed in versions 6.0.113-0ubuntu1~22.04.1, 6.0.113-0ubuntu1~22.10.1
dotnet-runtime-6.0 (Ubuntu package) - addressed in versions 6.0.113-0ubuntu1~22.04.1, 6.0.113-0ubuntu1~22.10.1
rh-dotnet60-dotnet (Red Hat package) - update to 6.0.113-1.el7_9
dotnet6.0 (Red Hat package) - addressed in versions 6.0.113-1.el8_7, 6.0.113-1.el9_1
dotnet6.0 - addressed in versions 6.0.113-1.fc36, 6.0.113-1.fc37
dotnet6.0 - update to 6.0.118-1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21538

• Denial of service in Microsoft .NET
• Ubuntu update for dotnet6
• Red Hat Enterprise Linux 8 update for .NET 6.0
• Red Hat Enterprise Linux 7 update for .NET 6.0
• Red Hat Enterprise Linux 9 update for .NET 6.0
• Multiple vulnerabilities in Oracle Linux
• Input validation error in IBM Robotic Process Automation for Cloud Pak
• Fedora 37 update for dotnet6.0
• Fedora 36 update for dotnet6.0
• Amazon Linux AMI update for dotnet6.0