CVE-2023-21538
published 2023-01-10CVE-2023-21538: .NET Denial of Service Vulnerability .NET Denial of Service Vulnerability
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.74%
84.6th percentile
.NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft.netcore.app.runtime.linux-arm | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.linux-arm64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-x64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.linux-x64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.osx-arm64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.osx-x64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.win-arm | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.win-arm64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.win-x64 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | microsoft.netcore.app.runtime.win-x86 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | net_6.0 | >= 6.0.0 < 6.0.13 | 6.0.13 |
| microsoft | powershell_7.2 | >= 7.2.0 < 7.2.9 | 7.2.9 |
| msrc | net_6.0 | — | — |
| msrc | powershell_7.2 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cvelistv57.5HIGH
ghsa7.5HIGH
osv7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
.NET 6 vulnerability
vendor_ubuntu·2023-01-10
CVE-2023-21538 .NET 6 vulnerability
Title: .NET 6 vulnerability
Summary: dotnet6 could be made to crash if it received specially crafted
network traffic.
Johan Gorter discovered that .NET 6 incorrectly processed certain
invalid HTTP requests. An attacker could possibly use this issue to
cause a denial of service condition for an exposed endpoint.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
.NET Denial of Service Vulnerability
vendor_msrc·2023-01-10·CVSS 7.5
CVE-2023-21538 [HIGH] CWE-502 .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
.NET Core: .NET Core
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;DOS:N/A
Reference: https://dotnet.microsoft.com/download/dotnet/6.0
Remediation: Release Notes
Reference: https://github.com/PowerShell/Announcements/issues/36
Red Hat
dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process
vendor_redhat·2023-01-10·CVSS 7.5
CVE-2023-21538 [HIGH] CWE-121 dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process
dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process
.NET Denial of Service Vulnerability
A vulnerability was found in dotnet. This flaw occurs when parsing an empty HTTP response as a JSON.NET JObject that causes a stack overflow and crashes a process.
Package: rh-dotnet31-dotnet (.NET Core 3.1 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnet50-dotnet (.NET Core 5.0 on Red Hat Enterprise Linux) - Not affected
Package: dotnet7.0 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet7.0 (Red Hat Enterprise Linux 9) - Not affected
OSV
.NET Denial of Service Vulnerability
osv·2023-01-10·CVSS 7.5
CVE-2023-21538 [HIGH] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
# Microsoft Security Advisory CVE-2023-21538: .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends an invalid request to an exposed endpoint.
## Discussion
Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/80449
### Mitigation factors
Microsoft has not identified any mitigating factors for this vulnerability.
##
CVEList
.NET Denial of Service Vulnerability
cvelistv5·2023-01-10·CVSS 7.5
CVE-2023-21538 [HIGH] CWE-502 .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
GHSA
.NET Denial of Service Vulnerability
ghsa·2023-01-10·CVSS 7.5
CVE-2023-21538 [HIGH] CWE-502 .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
# Microsoft Security Advisory CVE-2023-21538: .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends an invalid request to an exposed endpoint.
## Discussion
Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/80449
### Mitigation factors
Microsoft has not identified any mitigating factors for this vulnerability.
##
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-10
Published