CVE-2024-0057
dotnet: X509 Certificates - Validation Bypass across Azure
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami, Photon OS. Rated lower by Red Hat (high), AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).
Description
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk, powershell | 6.0.26, 7.0.15, 8.0.1 and 1 more |
| nuget::GitHub Security Advisory NuGet | NuGet.CommandLine, NuGet.Packaging, nuget.commandline and 1 more | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 |
| Photon OS 3.0 | powershell | 7.2.18-1.ph3 |
| Photon OS 4.0 | dotnet-runtime, dotnet-sdk, powershell | 6.0.36-1.ph4 and 2 more |
| Photon OS 5.0 | dotnet-sdk, powershell | 8.0.407-1.ph5 and 1 more |
| alma 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 and 27 more | 6.0.26-1.el8_9 and 5 more |
| alma 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 and 26 more | 6.0.26-1.el9_3 and 5 more |
| alpine 3.19 | dotnet6-build, dotnet6-runtime, dotnet7-build and 1 more | 6.0.126-r0 and 3 more |
| alpine 3.20 | dotnet6-build, dotnet6-runtime | 6.0.126-r0 and 1 more |
| amazon linux 2023 | aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet and 16 more | 6.0.26-1.amzn2023.0.1 and 1 more |
| Oracle Linux 8 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 and 27 more | 6.0.26-1.0.1.el8_9 and 5 more |
| Oracle Linux 9 | aspnetcore-runtime-6.0, aspnetcore-runtime-7.0, aspnetcore-runtime-8.0 and 26 more | 6.0.26-1.0.1.el9_3 and 5 more |
Show all 196 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 6.0.26, 7.0.15, 8.0.1 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 6.0.26, 7.0.15, 8.0.1 |
| bitnami::Bitnami Vulnerability Database | powershell | 7.2.18, 7.3.11, 7.4.12 |
| nuget::GitHub Security Advisory NuGet | NuGet.CommandLine | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 |
| nuget::GitHub Security Advisory NuGet | NuGet.Packaging | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 |
| nuget::GitHub Security Advisory NuGet | nuget.commandline | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 |
| nuget::GitHub Security Advisory NuGet | nuget.packaging | 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1 |
| Photon OS 3.0 | powershell | 7.2.18-1.ph3 |
| Photon OS 4.0 | dotnet-runtime | 6.0.36-1.ph4 |
| Photon OS 4.0 | dotnet-sdk | 6.0.428-1.ph4 |
| Photon OS 4.0 | powershell | 7.2.18-1.ph4 |
| Photon OS 5.0 | dotnet-sdk | 8.0.407-1.ph5 |
| Photon OS 5.0 | powershell | 7.4.1-1.ph5 |
| alma 8 | aspnetcore-runtime-6.0 | 6.0.26-1.el8_9 |
| alma 8 | aspnetcore-runtime-7.0 | 7.0.15-1.el8_9 |
| alma 8 | aspnetcore-runtime-8.0 | 8.0.1-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-7.0 | 7.0.15-1.el8_9 |
| alma 8 | aspnetcore-targeting-pack-8.0 | 8.0.1-1.el8_9 |
| alma 8 | dotnet | 8.0.101-1.el8_9 |
| alma 8 | dotnet-apphost-pack-6.0 | 6.0.26-1.el8_9 |
| alma 8 | dotnet-apphost-pack-7.0 | 7.0.15-1.el8_9 |
| alma 8 | dotnet-apphost-pack-8.0 | 8.0.1-1.el8_9 |
| alma 8 | dotnet-host | 8.0.1-1.el8_9 |
| alma 8 | dotnet-hostfxr-6.0 | 6.0.26-1.el8_9 |
| alma 8 | dotnet-hostfxr-7.0 | 7.0.15-1.el8_9 |
| alma 8 | dotnet-hostfxr-8.0 | 8.0.1-1.el8_9 |
| alma 8 | dotnet-runtime-6.0 | 6.0.26-1.el8_9 |
| alma 8 | dotnet-runtime-7.0 | 7.0.15-1.el8_9 |
| alma 8 | dotnet-runtime-8.0 | 8.0.1-1.el8_9 |
| alma 8 | dotnet-sdk-6.0 | 6.0.126-1.el8_9 |
| alma 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.el8_9 |
| alma 8 | dotnet-sdk-7.0 | 7.0.115-1.el8_9 |
| alma 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.115-1.el8_9 |
| alma 8 | dotnet-sdk-8.0 | 8.0.101-1.el8_9 |
| alma 8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.101-1.el8_9 |
| alma 8 | dotnet-targeting-pack-6.0 | 6.0.26-1.el8_9 |
| alma 8 | dotnet-targeting-pack-7.0 | 7.0.15-1.el8_9 |
| alma 8 | dotnet-targeting-pack-8.0 | 8.0.1-1.el8_9 |
| alma 8 | dotnet-templates-6.0 | 6.0.126-1.el8_9 |
| alma 8 | dotnet-templates-7.0 | 7.0.115-1.el8_9 |
| alma 8 | dotnet-templates-8.0 | 8.0.101-1.el8_9 |
| alma 8 | netstandard-targeting-pack-2.1 | 8.0.101-1.el8_9 |
| alma 9 | aspnetcore-runtime-6.0 | 6.0.26-1.el9_3 |
| alma 9 | aspnetcore-runtime-7.0 | 7.0.15-1.el9_3 |
| alma 9 | aspnetcore-runtime-8.0 | 8.0.1-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-7.0 | 7.0.15-1.el9_3 |
| alma 9 | aspnetcore-targeting-pack-8.0 | 8.0.1-1.el9_3 |
| alma 9 | dotnet-apphost-pack-6.0 | 6.0.26-1.el9_3 |
| alma 9 | dotnet-apphost-pack-7.0 | 7.0.15-1.el9_3 |
| alma 9 | dotnet-apphost-pack-8.0 | 8.0.1-1.el9_3 |
| alma 9 | dotnet-host | 8.0.1-1.el9_3 |
| alma 9 | dotnet-hostfxr-6.0 | 6.0.26-1.el9_3 |
| alma 9 | dotnet-hostfxr-7.0 | 7.0.15-1.el9_3 |
| alma 9 | dotnet-hostfxr-8.0 | 8.0.1-1.el9_3 |
| alma 9 | dotnet-runtime-6.0 | 6.0.26-1.el9_3 |
| alma 9 | dotnet-runtime-7.0 | 7.0.15-1.el9_3 |
| alma 9 | dotnet-runtime-8.0 | 8.0.1-1.el9_3 |
| alma 9 | dotnet-sdk-6.0 | 6.0.126-1.el9_3 |
| alma 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.el9_3 |
| alma 9 | dotnet-sdk-7.0 | 7.0.115-1.el9_3 |
| alma 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.115-1.el9_3 |
| alma 9 | dotnet-sdk-8.0 | 8.0.101-1.el9_3 |
| alma 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.101-1.el9_3 |
| alma 9 | dotnet-targeting-pack-6.0 | 6.0.26-1.el9_3 |
| alma 9 | dotnet-targeting-pack-7.0 | 7.0.15-1.el9_3 |
| alma 9 | dotnet-targeting-pack-8.0 | 8.0.1-1.el9_3 |
| alma 9 | dotnet-templates-6.0 | 6.0.126-1.el9_3 |
| alma 9 | dotnet-templates-7.0 | 7.0.115-1.el9_3 |
| alma 9 | dotnet-templates-8.0 | 8.0.101-1.el9_3 |
| alma 9 | netstandard-targeting-pack-2.1 | 8.0.101-1.el9_3 |
| alpine 3.19 | dotnet6-build | 6.0.126-r0 |
| alpine 3.19 | dotnet6-runtime | 6.0.26-r0 |
| alpine 3.19 | dotnet7-build | 7.0.115-r0 |
| alpine 3.19 | dotnet7-runtime | 7.0.15-r0 |
| alpine 3.20 | dotnet6-build | 6.0.126-r0 |
| alpine 3.20 | dotnet6-runtime | 6.0.26-r0 |
| amazon linux 2023 | aspnetcore-runtime-6.0 | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0 | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-apphost-pack-6.0-debuginfo | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-host-debuginfo | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0 | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-hostfxr-6.0-debuginfo | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0 | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-runtime-6.0-debuginfo | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0 | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-debuginfo | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-targeting-pack-6.0 | 6.0.26-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet-templates-6.0 | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debuginfo | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | dotnet6.0-debugsource | 6.0.126-1.amzn2023.0.1 |
| amazon linux 2023 | netstandard-targeting-pack-2.1 | 6.0.126-1.amzn2023.0.1 |
| Oracle Linux 8 | aspnetcore-runtime-6.0 | 6.0.26-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-runtime-7.0 | 7.0.15-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-runtime-8.0 | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-7.0 | 7.0.15-1.0.1.el8_9 |
| Oracle Linux 8 | aspnetcore-targeting-pack-8.0 | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet | 8.0.101-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-6.0 | 6.0.26-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-7.0 | 7.0.15-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-apphost-pack-8.0 | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-host | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-6.0 | 6.0.26-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-7.0 | 7.0.15-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-hostfxr-8.0 | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-6.0 | 6.0.26-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-7.0 | 7.0.15-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-runtime-8.0 | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0 | 6.0.126-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0 | 7.0.115-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.115-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-8.0 | 8.0.101-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.101-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-6.0 | 6.0.26-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-7.0 | 7.0.15-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-targeting-pack-8.0 | 8.0.1-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-6.0 | 6.0.126-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-7.0 | 7.0.115-1.0.1.el8_9 |
| Oracle Linux 8 | dotnet-templates-8.0 | 8.0.101-1.0.1.el8_9 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 8.0.101-1.0.1.el8_9 |
| Oracle Linux 9 | aspnetcore-runtime-6.0 | 6.0.26-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-7.0 | 7.0.15-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-runtime-8.0 | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-7.0 | 7.0.15-1.0.1.el9_3 |
| Oracle Linux 9 | aspnetcore-targeting-pack-8.0 | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-6.0 | 6.0.26-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-7.0 | 7.0.15-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-apphost-pack-8.0 | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-host | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-6.0 | 6.0.26-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-7.0 | 7.0.15-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-hostfxr-8.0 | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-6.0 | 6.0.26-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-7.0 | 7.0.15-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-runtime-8.0 | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0 | 6.0.126-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0 | 7.0.115-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.115-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0 | 8.0.101-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.101-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-6.0 | 6.0.26-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-7.0 | 7.0.15-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-targeting-pack-8.0 | 8.0.1-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-6.0 | 6.0.126-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-7.0 | 7.0.115-1.0.1.el9_3 |
| Oracle Linux 9 | dotnet-templates-8.0 | 8.0.101-1.0.1.el9_3 |
| Oracle Linux 9 | netstandard-targeting-pack-2.1 | 8.0.101-1.0.1.el9_3 |
| rapidfort amazon linux 2023 | dotnet | 6.0.126-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | dotnet-host | 6.0.26-1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | dotnet-host | 0:8.0.1-1.0.1.el9_3 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.126-1.el9_3 |
| rapidfort rocky 9 | dotnet7.0 | 0:7.0.115-1.el9_3 |
| rapidfort rocky 9 | dotnet8.0 | 0:8.0.101-1.el9_3 |
| rocky 8 | aspnetcore-runtime-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-runtime-7.0 | 0.0.0 |
| rocky 8 | aspnetcore-runtime-8.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | aspnetcore-targeting-pack-8.0 | 0.0.0 |
| rocky 8 | dotnet | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-apphost-pack-8.0 | 0.0.0 |
| rocky 8 | dotnet-host | 0.0.0 |
| rocky 8 | dotnet-hostfxr-6.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-7.0 | 0.0.0 |
| rocky 8 | dotnet-hostfxr-8.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-6.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-7.0 | 0.0.0 |
| rocky 8 | dotnet-runtime-8.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-6.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-7.0 | 0.0.0 |
| rocky 8 | dotnet-sdk-8.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-6.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-7.0 | 0.0.0 |
| rocky 8 | dotnet-targeting-pack-8.0 | 0.0.0 |
| rocky 8 | dotnet-templates-6.0 | 0.0.0 |
| rocky 8 | dotnet-templates-7.0 | 0.0.0 |
| rocky 8 | dotnet-templates-8.0 | 0.0.0 |
| rocky 8 | netstandard-targeting-pack-2.1 | 0.0.0 |
| ubuntu 22.04 | dotnet6 | 6.0.126-0ubuntu1~22.04.1 |
| ubuntu 22.04 | dotnet7 | 7.0.115-0ubuntu1~22.04.1 |
| ubuntu 23.04 | dotnet6 | 6.0.126-0ubuntu1~23.04.1 |
| ubuntu 23.04 | dotnet7 | 7.0.115-0ubuntu1~23.04.1 |
| ubuntu 23.10 | dotnet6 | 6.0.126-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet7 | 7.0.115-0ubuntu1~23.10.1 |
| ubuntu 23.10 | dotnet8 | 8.0.101-8.0.1-0ubuntu1~23.10.1 |
References
- https://access.redhat.com/errata/RHSA-2024:0156
- https://access.redhat.com/security/cve/CVE-2024-0057
- https://bugzilla.redhat.com/2255384
- https://bugzilla.redhat.com/2255386
- https://bugzilla.redhat.com/2257566
- https://bugzilla.redhat.com/show_bug.cgi?id=2255384
- https://bugzilla.redhat.com/show_bug.cgi?id=2255386
- https://bugzilla.redhat.com/show_bug.cgi?id=2257566
All 27 references
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0056
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0057
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21319
- https://devblogs.microsoft.com/dotnet/january-2024-updates/
- https://errata.almalinux.org/9/ALSA-2024-0156.html
- https://errata.rockylinux.org/RLSA-2024:0158
- https://github.com/NuGet/NuGet.Client
- https://github.com/NuGet/NuGet.Client/commit/3333f352ec47f0ebb489f20353dea7017f6cb00c
- https://github.com/NuGet/NuGet.Client/commit/5e1ba955cca14328d2cb5723f211d5fbc9bcacb3
- https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-68w7-72jg-6qpp
- https://github.com/dotnet/core/blob/ce802c56fde3abe2ae14ad09a1b8991b6709c18b/release-notes/6.0/6.0.26/6.0.26.md
- https://linux.oracle.com/cve/CVE-2024-0057.html
- https://linux.oracle.com/errata/ELSA-2024-0158.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057
- https://nvd.nist.gov/vuln/detail/CVE-2024-0057
- https://security.netapp.com/advisory/ntap-20240208-0007
- https://security.netapp.com/advisory/ntap-20240208-0007/
- https://ubuntu.com/security/notices/USN-6578-1
- https://www.cve.org/CVERecord?id=CVE-2024-0057