kritisch
CVE-2023-36049
dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami, Photon OS. Niedriger laut GHSA (hoch), Red Hat (mittel), AlmaLinux (mittel), Amazon (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (mittel).
Beschreibung
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 und 27 weitere | 6.0.25-1.el8_9 und 5 weitere |
| alma 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 und 26 weitere | 6.0.25-1.el9_3 und 5 weitere |
| alpine 3.18 | dotnet6-build, dotnet6-runtime, dotnet7-build und 1 weitere | 6.0.125-r0 und 3 weitere |
| alpine 3.19 | dotnet6-build, dotnet6-runtime, dotnet7-build und 1 weitere | 6.0.125-r0 und 3 weitere |
| alpine 3.20 | dotnet6-build, dotnet6-runtime | 6.0.125-r0 und 1 weitere |
| amazon linux 2023 | aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet und 16 weitere | 6.0.25-1.amzn2023.0.1 und 1 weitere |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests, system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-targeting-pack-6.0 und 18 weitere | 6.0.25-1.0.2.el8_9 und 3 weitere |
| Oracle Linux 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 und 26 weitere | 6.0.25-1.0.1.el9_3 und 5 weitere |
Alle 173 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 6.0.25, 7.0.14 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet | 8.0.100-2.el8_9 |
| alma 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-apphost-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-host | 8.0.0-2.el8_9 |
| alma 8 | dotnet-hostfxr-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-hostfxr-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-hostfxr-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-sdk-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-8.0 | 8.0.100-2.el8_9 |
| alma 8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el8_9 |
| alma 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-templates-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-templates-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-templates-8.0 | 8.0.100-2.el8_9 |
| alma 8 | netstandard-targeting-pack-2.1 | 8.0.100-2.el8_9 |
| alma 9 | aspnetcore-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-host | 8.0.0-2.el9_3 |
| alma 9 | dotnet-hostfxr-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-hostfxr-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-hostfxr-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-sdk-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-8.0 | 8.0.100-2.el9_3 |
| alma 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el9_3 |
| alma 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-templates-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-templates-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-templates-8.0 | 8.0.100-2.el9_3 |
| alma 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.el9_3 |
| alpine 3.18 | dotnet6-build | 6.0.125-r0 |
| alpine 3.18 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.18 | dotnet7-build | 7.0.114-r0 |
| alpine 3.18 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.19 | dotnet6-build | 6.0.125-r0 |
| alpine 3.19 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.19 | dotnet7-build | 7.0.114-r0 |
| alpine 3.19 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.20 | dotnet6-build | 6.0.125-r0 |
| alpine 3.20 | dotnet6-runtime | 6.0.25-r0 |
| amazon linux 2023 | aspnetcore-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debugsource | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | netstandard-targeting-pack-2.1 | 6.0.125-1.amzn2023.0.1 |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests | 8.0.0, 6.0.25, 7.0.14 |
| nuget::GitHub Security Advisory NuGet | system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-host | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-templates-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 9 | aspnetcore-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-host | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.0.1.el9_3 |
| rapidfort amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | dotnet-host | 0:7.0.14-1.0.1.el9_3 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.125-1.el9_3 |
| rapidfort rocky 9 | dotnet7.0 | 0:7.0.114-1.el9_3 |
| rapidfort rocky 9 | dotnet8.0 | 0:8.0.100-2.el9_3 |
| rocky 8 | aspnetcore-runtime-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-runtime-7.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-6.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-7.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-6.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-7.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-6.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-7.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-templates-6.0 | 0.0.0 |
| rocky 8 | dotnet-templates-7.0 | 0.0.0 |
| ubuntu 22.04 | dotnet6 | 6.0.125-0ubuntu1~22.04.1 |
| ubuntu 22.04 | dotnet7 | 7.0.114-0ubuntu1~22.04.1 |
| ubuntu 23.04 | dotnet6 | 6.0.125-0ubuntu1~23.04.1 |
| ubuntu 23.04 | dotnet7 | 7.0.114-0ubuntu1~23.04.1 |
| ubuntu 23.10 | dotnet6 | 6.0.125-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet7 | 7.0.114-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet8 | 8.0.100-8.0.0-0ubuntu1~23.10.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2023:7257
- https://access.redhat.com/security/cve/CVE-2023-36049
- https://bugzilla.redhat.com/2247750
- https://bugzilla.redhat.com/2248883
- https://bugzilla.redhat.com/show_bug.cgi?id=2247750
- https://bugzilla.redhat.com/show_bug.cgi?id=2248883
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36558
Alle 20 Referenzen
- https://devblogs.microsoft.com/dotnet/november-2023-updates
- https://errata.almalinux.org/9/ALSA-2023-7257.html
- https://errata.rockylinux.org/RLSA-2023:7258
- https://github.com/dotnet/announcements/issues/287
- https://github.com/dotnet/runtime
- https://github.com/dotnet/runtime/security/advisories/GHSA-c3hf-8vgx-72rh
- https://linux.oracle.com/cve/CVE-2023-36049.html
- https://linux.oracle.com/errata/ELSA-2023-7258.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049
- https://nvd.nist.gov/vuln/detail/CVE-2023-36049
- https://ubuntu.com/security/notices/USN-6480-1
- https://www.cve.org/CVERecord?id=CVE-2023-36049