PT-2022-1791 · Microsoft+5 · Net 5.0+7

Published 2022-02-08 · Updated 2024-03-06 · CVE-2022-21986

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions .NET 6.0 versions 6.0.0 through 6.0.1 .NET 5.0 versions 5.0.0 through 5.0.13

Description A Denial of Service issue exists in .NET 6.0 and .NET 5.0 when the Kestrel web server processes certain HTTP/2 and HTTP/3 requests. This is due to insufficient input validation. Exploitation of this issue could allow a remote attacker to cause a denial of service.

Recommendations For .NET 6.0 versions 6.0.0 through 6.0.1, update to .NET 6.0.2 or install SDK 6.0.102. For .NET 5.0 versions 5.0.0 through 5.0.13, update to Runtime 5.0.14 or install SDK 5.0.114 or SDK 5.0.405. As a temporary workaround, consider restricting access to the Kestrel web server until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2022:0496

ALT-PU-2022-1269

ALT-PU-2022-1270

ALT-PU-2022-1357

ALT-PU-2022-1358

ALT-PU-2022-1544

ALT-PU-2022-1545

BDU:2022-01176

BIT-DOTNET-2022-21986

BIT-DOTNET-SDK-2022-21986

CESA-2022_0495

CESA-2022_0496

CVE-2022-21986

GHSA-X459-P2RX-F8FF

RHSA-2022:0495

RHSA-2022:0496

RHSA-2022:0499

RHSA-2022:0500

RHSA-2022_0495

RHSA-2022_0496

RLSA-2022:0495

RLSA-2022:0496

Affected Products

Alt Linux

Almalinux

Centos

Kestrel

Net 5.0

Net 6.0

Red Hat

Rocky Linux

References · 33

• https://osv.dev/vulnerability/RLSA-2022:0496 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4HMQOHV7G5TF6OMBN6DNTDOKQQU7KHMM · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/682940 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21986 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2022-21986 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21986 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21986 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21986 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:0495 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CCTBSBE3PNIMXG6ALX2CQG4ZEH7W3YAT · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0496.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x459-p2rx-f8ff · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-2022-21986 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:0495 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:0496 · Vendor Advisory