crítica
CVE-2023-36049
dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami, Photon OS. Más baja según GHSA (alta), Red Hat (media), AlmaLinux (media), Amazon (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 y 27 más | 6.0.25-1.el8_9 y 5 más |
| alma 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 y 26 más | 6.0.25-1.el9_3 y 5 más |
| alpine 3.18 | dotnet6-build, dotnet6-runtime, dotnet7-build y 1 más | 6.0.125-r0 y 3 más |
| alpine 3.19 | dotnet6-build, dotnet6-runtime, dotnet7-build y 1 más | 6.0.125-r0 y 3 más |
| alpine 3.20 | dotnet6-build, dotnet6-runtime | 6.0.125-r0 y 1 más |
| amazon linux 2023 | aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet y 16 más | 6.0.25-1.amzn2023.0.1 y 1 más |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests, system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-targeting-pack-6.0 y 18 más | 6.0.25-1.0.2.el8_9 y 3 más |
| Oracle Linux 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 y 26 más | 6.0.25-1.0.1.el9_3 y 5 más |
Mostrar las 173 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 6.0.25, 7.0.14 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet | 8.0.100-2.el8_9 |
| alma 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-apphost-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-host | 8.0.0-2.el8_9 |
| alma 8 | dotnet-hostfxr-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-hostfxr-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-hostfxr-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-sdk-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-8.0 | 8.0.100-2.el8_9 |
| alma 8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el8_9 |
| alma 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-templates-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-templates-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-templates-8.0 | 8.0.100-2.el8_9 |
| alma 8 | netstandard-targeting-pack-2.1 | 8.0.100-2.el8_9 |
| alma 9 | aspnetcore-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-host | 8.0.0-2.el9_3 |
| alma 9 | dotnet-hostfxr-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-hostfxr-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-hostfxr-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-sdk-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-8.0 | 8.0.100-2.el9_3 |
| alma 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el9_3 |
| alma 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-templates-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-templates-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-templates-8.0 | 8.0.100-2.el9_3 |
| alma 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.el9_3 |
| alpine 3.18 | dotnet6-build | 6.0.125-r0 |
| alpine 3.18 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.18 | dotnet7-build | 7.0.114-r0 |
| alpine 3.18 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.19 | dotnet6-build | 6.0.125-r0 |
| alpine 3.19 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.19 | dotnet7-build | 7.0.114-r0 |
| alpine 3.19 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.20 | dotnet6-build | 6.0.125-r0 |
| alpine 3.20 | dotnet6-runtime | 6.0.25-r0 |
| amazon linux 2023 | aspnetcore-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debugsource | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | netstandard-targeting-pack-2.1 | 6.0.125-1.amzn2023.0.1 |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests | 8.0.0, 6.0.25, 7.0.14 |
| nuget::GitHub Security Advisory NuGet | system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-host | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-templates-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 9 | aspnetcore-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-host | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.0.1.el9_3 |
| rapidfort amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | dotnet-host | 0:7.0.14-1.0.1.el9_3 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.125-1.el9_3 |
| rapidfort rocky 9 | dotnet7.0 | 0:7.0.114-1.el9_3 |
| rapidfort rocky 9 | dotnet8.0 | 0:8.0.100-2.el9_3 |
| rocky 8 | aspnetcore-runtime-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-runtime-7.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-6.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-7.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-6.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-7.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-6.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-7.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-templates-6.0 | 0.0.0 |
| rocky 8 | dotnet-templates-7.0 | 0.0.0 |
| ubuntu 22.04 | dotnet6 | 6.0.125-0ubuntu1~22.04.1 |
| ubuntu 22.04 | dotnet7 | 7.0.114-0ubuntu1~22.04.1 |
| ubuntu 23.04 | dotnet6 | 6.0.125-0ubuntu1~23.04.1 |
| ubuntu 23.04 | dotnet7 | 7.0.114-0ubuntu1~23.04.1 |
| ubuntu 23.10 | dotnet6 | 6.0.125-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet7 | 7.0.114-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet8 | 8.0.100-8.0.0-0ubuntu1~23.10.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2023:7257
- https://access.redhat.com/security/cve/CVE-2023-36049
- https://bugzilla.redhat.com/2247750
- https://bugzilla.redhat.com/2248883
- https://bugzilla.redhat.com/show_bug.cgi?id=2247750
- https://bugzilla.redhat.com/show_bug.cgi?id=2248883
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36558
Las 20 referencias
- https://devblogs.microsoft.com/dotnet/november-2023-updates
- https://errata.almalinux.org/9/ALSA-2023-7257.html
- https://errata.rockylinux.org/RLSA-2023:7258
- https://github.com/dotnet/announcements/issues/287
- https://github.com/dotnet/runtime
- https://github.com/dotnet/runtime/security/advisories/GHSA-c3hf-8vgx-72rh
- https://linux.oracle.com/cve/CVE-2023-36049.html
- https://linux.oracle.com/errata/ELSA-2023-7258.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049
- https://nvd.nist.gov/vuln/detail/CVE-2023-36049
- https://ubuntu.com/security/notices/USN-6480-1
- https://www.cve.org/CVERecord?id=CVE-2023-36049