kritik
CVE-2023-36049
dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami, Photon OS. Daha düşük diyenler: GHSA (yüksek), Red Hat (orta), AlmaLinux (orta), Amazon (orta), Oracle (orta), Rocky Linux (orta), Ubuntu (orta).
Açıklama
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 ve 27 tane daha | 6.0.25-1.el8_9 ve 5 tane daha |
| alma 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 ve 26 tane daha | 6.0.25-1.el9_3 ve 5 tane daha |
| alpine 3.18 | dotnet6-build, dotnet6-runtime, dotnet7-build ve 1 tane daha | 6.0.125-r0 ve 3 tane daha |
| alpine 3.19 | dotnet6-build, dotnet6-runtime, dotnet7-build ve 1 tane daha | 6.0.125-r0 ve 3 tane daha |
| alpine 3.20 | dotnet6-build, dotnet6-runtime | 6.0.125-r0 ve 1 tane daha |
| amazon linux 2023 | aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet ve 16 tane daha | 6.0.25-1.amzn2023.0.1 ve 1 tane daha |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests, system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-targeting-pack-6.0 ve 18 tane daha | 6.0.25-1.0.2.el8_9 ve 3 tane daha |
| Oracle Linux 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 ve 26 tane daha | 6.0.25-1.0.1.el9_3 ve 5 tane daha |
19 kaynaktaki 173 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 6.0.25, 7.0.14 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 6.0.25, 7.0.14 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet | 8.0.100-2.el8_9 |
| alma 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-apphost-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-host | 8.0.0-2.el8_9 |
| alma 8 | dotnet-hostfxr-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-hostfxr-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-hostfxr-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-runtime-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-runtime-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-runtime-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-sdk-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el8_9 |
| alma 8 | dotnet-sdk-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el8_9 |
| alma 8 | dotnet-sdk-8.0 | 8.0.100-2.el8_9 |
| alma 8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el8_9 |
| alma 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.el8_9 |
| alma 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.el8_9 |
| alma 8 | dotnet-targeting-pack-8.0 | 8.0.0-2.el8_9 |
| alma 8 | dotnet-templates-6.0 | 6.0.125-1.el8_9 |
| alma 8 | dotnet-templates-7.0 | 7.0.114-1.el8_9 |
| alma 8 | dotnet-templates-8.0 | 8.0.100-2.el8_9 |
| alma 8 | netstandard-targeting-pack-2.1 | 8.0.100-2.el8_9 |
| alma 9 | aspnetcore-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-host | 8.0.0-2.el9_3 |
| alma 9 | dotnet-hostfxr-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-hostfxr-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-hostfxr-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-runtime-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-runtime-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-runtime-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-sdk-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.el9_3 |
| alma 9 | dotnet-sdk-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.el9_3 |
| alma 9 | dotnet-sdk-8.0 | 8.0.100-2.el9_3 |
| alma 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.el9_3 |
| alma 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.el9_3 |
| alma 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.el9_3 |
| alma 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.el9_3 |
| alma 9 | dotnet-templates-6.0 | 6.0.125-1.el9_3 |
| alma 9 | dotnet-templates-7.0 | 7.0.114-1.el9_3 |
| alma 9 | dotnet-templates-8.0 | 8.0.100-2.el9_3 |
| alma 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.el9_3 |
| alpine 3.18 | dotnet6-build | 6.0.125-r0 |
| alpine 3.18 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.18 | dotnet7-build | 7.0.114-r0 |
| alpine 3.18 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.19 | dotnet6-build | 6.0.125-r0 |
| alpine 3.19 | dotnet6-runtime | 6.0.25-r0 |
| alpine 3.19 | dotnet7-build | 7.0.114-r0 |
| alpine 3.19 | dotnet7-runtime | 7.0.14-r0 |
| alpine 3.20 | dotnet6-build | 6.0.125-r0 |
| alpine 3.20 | dotnet6-runtime | 6.0.25-r0 |
| amazon linux 2023 | aspnetcore-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0-debuginfo | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-6.0 | 6.0.25-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-6.0 | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debuginfo | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debugsource | 6.0.125-1.amzn2023.0.1 |
| amazon linux 2023 | netstandard-targeting-pack-2.1 | 6.0.125-1.amzn2023.0.1 |
| nuget::GitHub Security Advisory NuGet | System.Net.Requests | 8.0.0, 6.0.25, 7.0.14 |
| nuget::GitHub Security Advisory NuGet | system.net.requests | 8.0.0, 6.0.25, 7.0.14 |
| Oracle Linux 8 | aspnetcore-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-host | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-6.0 | 6.0.125-1.0.2.el8_9 |
| Oracle Linux 8 | dotnet-templates-7.0 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 7.0.114-1.0.1.el8_9 |
| Oracle Linux 9 | aspnetcore-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-host | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-6.0 | 6.0.25-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-7.0 | 7.0.14-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-8.0 | 8.0.0-2.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-6.0 | 6.0.125-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-7.0 | 7.0.114-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-8.0 | 8.0.100-2.0.1.el9_3 |
| Oracle Linux 9 | netstandard-targeting-pack-2.1 | 8.0.100-2.0.1.el9_3 |
| rapidfort amazon linux 2023 | dotnet | 6.0.125-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 6.0.25-1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | dotnet-host | 0:7.0.14-1.0.1.el9_3 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.125-1.el9_3 |
| rapidfort rocky 9 | dotnet7.0 | 0:7.0.114-1.el9_3 |
| rapidfort rocky 9 | dotnet8.0 | 0:8.0.100-2.el9_3 |
| rocky 8 | aspnetcore-runtime-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-runtime-7.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-6.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-7.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-6.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-7.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-6.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-7.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-templates-6.0 | 0.0.0 |
| rocky 8 | dotnet-templates-7.0 | 0.0.0 |
| ubuntu 22.04 | dotnet6 | 6.0.125-0ubuntu1~22.04.1 |
| ubuntu 22.04 | dotnet7 | 7.0.114-0ubuntu1~22.04.1 |
| ubuntu 23.04 | dotnet6 | 6.0.125-0ubuntu1~23.04.1 |
| ubuntu 23.04 | dotnet7 | 7.0.114-0ubuntu1~23.04.1 |
| ubuntu 23.10 | dotnet6 | 6.0.125-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet7 | 7.0.114-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet8 | 8.0.100-8.0.0-0ubuntu1~23.10.1 |
Referanslar
- https://access.redhat.com/errata/RHSA-2023:7257
- https://access.redhat.com/security/cve/CVE-2023-36049
- https://bugzilla.redhat.com/2247750
- https://bugzilla.redhat.com/2248883
- https://bugzilla.redhat.com/show_bug.cgi?id=2247750
- https://bugzilla.redhat.com/show_bug.cgi?id=2248883
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36558
20 referansın hepsi
- https://devblogs.microsoft.com/dotnet/november-2023-updates
- https://errata.almalinux.org/9/ALSA-2023-7257.html
- https://errata.rockylinux.org/RLSA-2023:7258
- https://github.com/dotnet/announcements/issues/287
- https://github.com/dotnet/runtime
- https://github.com/dotnet/runtime/security/advisories/GHSA-c3hf-8vgx-72rh
- https://linux.oracle.com/cve/CVE-2023-36049.html
- https://linux.oracle.com/errata/ELSA-2023-7258.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049
- https://nvd.nist.gov/vuln/detail/CVE-2023-36049
- https://ubuntu.com/security/notices/USN-6480-1
- https://www.cve.org/CVERecord?id=CVE-2023-36049