The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0495 advisory.

  - .NET Denial of Service Vulnerability (CVE-2022-21986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0496 advisory.

  - .NET Denial of Service Vulnerability (CVE-2022-21986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:0496 advisory.

  - .NET Denial of Service Vulnerability. (CVE-2022-21986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0496 advisory.

    [6.0.102-1.0.1]
    - Add missing Oracle RIDs

    [6.0.102-1]
    - Update to .NET SDK 6.0.102 and Runtime 6.0.2
    - Resolves: RHBZ#2048257

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0495 advisory.

    [5.0.211-1.0.1]
    - Support AArch64 on Oracle Linux [Orabug: 32738620]
    - Include new Oracle Linux runtime IDs       Add 1000-Add-missing-OL-RIDs.patch

    [5.0.211-1]
    - Update to .NET SDK 5.0.211 and Runtime 5.0.14
    - Resolves: RHBZ#2047767

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:0495 advisory.

  - dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service (CVE-2022-21986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET core installation on the remote host is version 5.0 prior to 5.0.14 or version 6.0 prior to 6.0.2.
It is, therefore, affected by a denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET core installation on the remote macOS host is version 5.0 prior to 5.0.14 or version 6.0 prior to 6.0.2. It is, therefore, affected by a denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0496 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.102 and .NET Runtime 6.0.2.

    Security Fix(es):

    * dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service (CVE-2022-219862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0495 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.211 and .NET Runtime 5.0.14.

    Security Fix(es):

    * dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service (CVE-2022-219862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0499 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.211 and .NET Runtime 5.0.14.

    Security Fix(es):

    * dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service (CVE-2022-219862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0500 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.102 and .NET Runtime 6.0.2.

    Security Fix(es):

    * dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service (CVE-2022-219862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by a denial of service (DoS) vulnerability. An unauthenticated, remote attacker can exploit this issue to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio 2019 runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by the following vulnerability:

  - A Denial of Service vulnerability exists in .NET 6.0 and .NET 5.0 when the Kestrel web server processes     certain HTTP/2 and HTTP/3 requests.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184979	Rocky Linux 8 : .NET 5.0 (RLSA-2022:0495)	Nessus	Rocky Linux Local Security Checks	high
184643	Rocky Linux 8 : .NET 6.0 (RLSA-2022:0496)	Nessus	Rocky Linux Local Security Checks	high
158824	AlmaLinux 8 : .NET 6.0 (ALSA-2022:0496)	Nessus	Alma Linux Local Security Checks	high
158726	Oracle Linux 8 : .NET / 6.0 (ELSA-2022-0496)	Nessus	Oracle Linux Local Security Checks	high
158099	Oracle Linux 8 : .NET / 5.0 (ELSA-2022-0495)	Nessus	Oracle Linux Local Security Checks	high
158086	CentOS 8 : .NET 5.0 (CESA-2022:0495)	Nessus	CentOS Local Security Checks	high
157879	Security Update for .NET Core (February 2022)	Nessus	Windows	high
157878	Security Update for .NET Core (February 2022) (macOS)	Nessus	MacOS X Local Security Checks	high
157875	RHEL 8 : .NET 6.0 (RHSA-2022:0496)	Nessus	Red Hat Local Security Checks	high
157874	RHEL 8 : .NET 5.0 (RHSA-2022:0495)	Nessus	Red Hat Local Security Checks	high
157873	RHEL 7 : .NET 5.0 on RHEL 7 (RHSA-2022:0499)	Nessus	Red Hat Local Security Checks	high
157861	RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:0500)	Nessus	Red Hat Local Security Checks	high
157841	Security Updates for Microsoft Visual Studio Products (February 2022)	Nessus	Windows : Microsoft Bulletins	high
157434	Security Update for Visual Studio 2019 (February 2022) (macOS)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2022-21986

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high