kritisch
CVE-2026-40372
ASP.NET Core: ASP.NET: ASP.NET Core: Privilege escalation via improper cryptographic signature verification
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
GHSA9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA, Red Hat, Bitnami. Niedriger laut Amazon (hoch), Ubuntu (mittel).
Beschreibung
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | aspnet-core | 10.0.7 |
| nuget::GitHub Security Advisory NuGet | Microsoft.AspNetCore.DataProtection, microsoft.aspnetcore.dataprotection | 10.0.7 |
| alpine 3.23 | dotnet10-runtime | 10.0.7-r0 |
| alpine 3.24 | dotnet10-runtime | 10.0.7-r0 |
| alpine edge | dotnet10-runtime | 10.0.7-r0 |
| amazon linux 2023 | aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 und 20 weitere | 10.0.7-1.amzn2023.0.1 und 1 weitere |
| rapidfort amazon linux 2023 | dotnet, dotnet-host | 10.0.107-1.amzn2023.0.1 und 1 weitere |
| rapidfort ubuntu 20.04 | dotnet10, dotnet7 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 22.04 | dotnet10, dotnet7 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 24.04 | dotnet10, dotnet7 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| ubuntu 24.04 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~24.04.1 |
| ubuntu 25.10 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~25.10.1 |
Alle 40 Einträge aus 13 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | aspnet-core | 10.0.7 |
| nuget::GitHub Security Advisory NuGet | Microsoft.AspNetCore.DataProtection | 10.0.7 |
| nuget::GitHub Security Advisory NuGet | microsoft.aspnetcore.dataprotection | 10.0.7 |
| alpine 3.23 | dotnet10-runtime | 10.0.7-r0 |
| alpine 3.24 | dotnet10-runtime | 10.0.7-r0 |
| alpine edge | dotnet10-runtime | 10.0.7-r0 |
| amazon linux 2023 | aspnetcore-runtime-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-runtime-dbg-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-10.0-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-10.0-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-10.0-debuginfo | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-dbg-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-10.0-debuginfo | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-10.0-source-built-artifacts | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-aot-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-aot-10.0-debuginfo | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-dbg-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-10.0 | 10.0.7-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-10.0 | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet10.0-debuginfo | 10.0.107-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet10.0-debugsource | 10.0.107-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet | 10.0.107-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 10.0.7-1.amzn2023.0.1 |
| rapidfort ubuntu 20.04 | dotnet10 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 20.04 | dotnet7 | kein Fix angegeben |
| rapidfort ubuntu 22.04 | dotnet10 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 22.04 | dotnet7 | kein Fix angegeben |
| rapidfort ubuntu 24.04 | dotnet10 | 0:10.0.107-10.0.7-0ubuntu1~24.04.1, 0:10.0.107-10.0.7-0ubuntu1~25.10.1, 0:10.0.107-10.0.7-0ubuntu1~26.04.1 |
| rapidfort ubuntu 24.04 | dotnet7 | kein Fix angegeben |
| ubuntu 24.04 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~24.04.1 |
| ubuntu 25.10 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~25.10.1 |
| ubuntu 26.04 | dotnet10 | 10.0.107-10.0.7-0ubuntu1~26.04.1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-40372
- https://bugzilla.redhat.com/show_bug.cgi?id=2460224
- https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/
- https://github.com/dotnet/announcements/issues/395
- https://github.com/dotnet/aspnetcore
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-9mv3-2cwr-p262
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
- https://nvd.nist.gov/vuln/detail/CVE-2026-40372