PT-2023-9822 · Microsoft+8 · .Net Sdk+9

Kalle Niemitalo · Published 2023-04-04 · Updated 2024-12-13 · CVE-2023-29337

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NuGet versions 6.6.0 and earlier NuGet versions 6.5.0 and earlier NuGet versions 6.4.1 and earlier NuGet versions 6.3.2 and earlier NuGet versions 6.2.3 and earlier NuGet versions 6.0.4 and earlier NuGet version 5.11.4 .NET SDK versions 7.0.106 and earlier, or 7.0.303 and earlier .NET SDK versions 6.0.117 and earlier, or 6.0.312 and earlier, or 6.0.409 and earlier

Description A vulnerability exists in NuGet and .NET on Linux, where a potential race condition can lead to a symlink attack. This issue allows a remote attacker to execute arbitrary code. The vulnerability is related to errors in synchronization when using a shared resource. Non-Linux platforms are not affected.

Recommendations If you're using NuGet.exe 6.6.0 or lower, download and install 6.6.1 from https://dist.nuget.org/win-x86-commandline/v6.6.1/nuget.exe. If you're using NuGet.exe 6.5.0 or lower, download and install 6.5.1 from https://dist.nuget.org/win-x86-commandline/v6.5.1/nuget.exe. If you're using NuGet.exe 6.4.1 or lower, download and install 6.4.2 from https://dist.nuget.org/win-x86-commandline/v6.4.2/nuget.exe. If you're using NuGet.exe 6.3.2 or lower, download and install 6.3.3 from https://dist.nuget.org/win-x86-commandline/v6.3.3/nuget.exe. If you're using NuGet.exe 6.2.3 or lower, download and install 6.2.4 from https://dist.nuget.org/win-x86-commandline/v6.2.4/nuget.exe. If you're using NuGet.exe 6.0.4 or lower, download and install 6.0.5 from https://dist.nuget.org/win-x86-commandline/v6.0.5/nuget.exe. If you're using NuGet.exe 5.11.4 or lower, download and install 5.11.5 from https://dist.nuget.org/win-x86-commandline/v5.11.5/nuget.exe. If you're using .NET 7.0, download and install Runtime 7.0.7 or SDK 7.0.107 or SDK 7.0.304 from https://dotnet.microsoft.com/download/dotnet-core/7.0. If you're using .NET 6.0, download and install Runtime 6.0.18 or SDK 6.0.118 or SDK 6.0.312 from https://dotnet.microsoft.com/download/dotnet-core/6.0.

Fix

RCE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

ALSA-2023:3581

ALSA-2023:3582

ALSA-2023:3592

ALSA-2023:3593

ALT-PU-2023-4590

ALT-PU-2023-4591

ALT-PU-2023-4592

ALT-PU-2023-4593

ALT-PU-2023-4594

ALT-PU-2023-4595

ALT-PU-2023-4610

ALT-PU-2023-4611

ALT-PU-2024-16792

ALT-PU-2024-16794

ALT-PU-2024-16796

ALT-PU-2024-16939

BDU:2024-11602

CESA-2023_3582

CESA-2023_3593

CVE-2023-29337

GHSA-6QMF-MMC7-6C2P

RHSA-2023:3580

RHSA-2023:3581

RHSA-2023:3582

RHSA-2023:3592

RHSA-2023:3593

RHSA-2023:4448

RHSA-2023:4449

RHSA-2023_3581

RHSA-2023_3582

RHSA-2023_3592

RHSA-2023_3593

RLSA-2023:3582

RLSA-2023:3593

USN-6161-1

USN-6161-2

Affected Products

.Net Sdk

Alt Linux

Almalinux

Centos

Debian

Linuxmint

Nuget

Red Hat

Rocky Linux

Ubuntu

References · 66

• https://osv.dev/vulnerability/ALSA-2023:3593 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6161-2 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:3582 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-3582.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-6161-2 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-3581.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-6161-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29337 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29337 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-29337 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:3592 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:3582 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6161-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-33128 · Vendor Advisory