critique
CVE-2023-36049
dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami, Photon OS. Plus basse selon GHSA (élevée), Red Hat (moyenne), AlmaLinux (moyenne), Amazon (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne).
Description
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 et 27 autres | 6.0.25-1.el8_9 et 5 autres |
| alma 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 et 26 autres | 6.0.25-1.el9_3 et 5 autres |
| alpine 3.18 | dotnet6-build, dotnet6-runtime, dotnet7-build et 1 autres | 6.0.125-r0 et 3 autres |
| alpine 3.19 | dotnet6-build, dotnet6-runtime, dotnet7-build et 1 autres | 6.0.125-r0 et 3 autres |
| alpine 3.20 | dotnet6-build, dotnet6-runtime | 6.0.125-r0 et 1 autres |
| amazon linux 2023 | aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet et 16 autres | 6.0.25-1.amzn2023.0.1 et 1 autres |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests, system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-targeting-pack-6.0 et 18 autres | 6.0.25-1.0.2.el8_9 et 3 autres |
| Oracle Linux 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 et 26 autres | 6.0.25-1.0.1.el9_3 et 5 autres |
Afficher les 173 entrées de 19 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 6.0.25, 7.0.14 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet | 8.0.100-2.el8_9 |
| alma 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-apphost-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-host | 8.0.0-2.el8_9 |
| alma 8 | dotnet-hostfxr-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-hostfxr-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-hostfxr-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-sdk-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-8.0 | 8.0.100-2.el8_9 |
| alma 8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el8_9 |
| alma 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-templates-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-templates-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-templates-8.0 | 8.0.100-2.el8_9 |
| alma 8 | netstandard-targeting-pack-2.1 | 8.0.100-2.el8_9 |
| alma 9 | aspnetcore-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-host | 8.0.0-2.el9_3 |
| alma 9 | dotnet-hostfxr-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-hostfxr-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-hostfxr-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-sdk-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-8.0 | 8.0.100-2.el9_3 |
| alma 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el9_3 |
| alma 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-templates-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-templates-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-templates-8.0 | 8.0.100-2.el9_3 |
| alma 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.el9_3 |
| alpine 3.18 | dotnet6-build | 6.0.125-r0 |
| alpine 3.18 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.18 | dotnet7-build | 7.0.114-r0 |
| alpine 3.18 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.19 | dotnet6-build | 6.0.125-r0 |
| alpine 3.19 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.19 | dotnet7-build | 7.0.114-r0 |
| alpine 3.19 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.20 | dotnet6-build | 6.0.125-r0 |
| alpine 3.20 | dotnet6-runtime | 6.0.25-r0 |
| amazon linux 2023 | aspnetcore-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debugsource | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | netstandard-targeting-pack-2.1 | 6.0.125-1.amzn2023.0.1 |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests | 8.0.0, 6.0.25, 7.0.14 |
| nuget::GitHub Security Advisory NuGet | system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-host | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-templates-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 9 | aspnetcore-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-host | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.0.1.el9_3 |
| rapidfort amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | dotnet-host | 0:7.0.14-1.0.1.el9_3 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.125-1.el9_3 |
| rapidfort rocky 9 | dotnet7.0 | 0:7.0.114-1.el9_3 |
| rapidfort rocky 9 | dotnet8.0 | 0:8.0.100-2.el9_3 |
| rocky 8 | aspnetcore-runtime-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-runtime-7.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-6.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-7.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-6.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-7.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-6.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-7.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-templates-6.0 | 0.0.0 |
| rocky 8 | dotnet-templates-7.0 | 0.0.0 |
| ubuntu 22.04 | dotnet6 | 6.0.125-0ubuntu1~22.04.1 |
| ubuntu 22.04 | dotnet7 | 7.0.114-0ubuntu1~22.04.1 |
| ubuntu 23.04 | dotnet6 | 6.0.125-0ubuntu1~23.04.1 |
| ubuntu 23.04 | dotnet7 | 7.0.114-0ubuntu1~23.04.1 |
| ubuntu 23.10 | dotnet6 | 6.0.125-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet7 | 7.0.114-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet8 | 8.0.100-8.0.0-0ubuntu1~23.10.1 |
Références
- https://access.redhat.com/errata/RHSA-2023:7257
- https://access.redhat.com/security/cve/CVE-2023-36049
- https://bugzilla.redhat.com/2247750
- https://bugzilla.redhat.com/2248883
- https://bugzilla.redhat.com/show_bug.cgi?id=2247750
- https://bugzilla.redhat.com/show_bug.cgi?id=2248883
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36558
Les 20 références
- https://devblogs.microsoft.com/dotnet/november-2023-updates
- https://errata.almalinux.org/9/ALSA-2023-7257.html
- https://errata.rockylinux.org/RLSA-2023:7258
- https://github.com/dotnet/announcements/issues/287
- https://github.com/dotnet/runtime
- https://github.com/dotnet/runtime/security/advisories/GHSA-c3hf-8vgx-72rh
- https://linux.oracle.com/cve/CVE-2023-36049.html
- https://linux.oracle.com/errata/ELSA-2023-7258.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049
- https://nvd.nist.gov/vuln/detail/CVE-2023-36049
- https://ubuntu.com/security/notices/USN-6480-1
- https://www.cve.org/CVERecord?id=CVE-2023-36049