NuGet Client Elevation of Privilege Vulnerability

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2c37647a9c advisory.

    This is the October 2022 monthly update for .NET 6.

    It updates the SDK to 6.0.110 and the Runtime to 6.0.10.

    This update includes a fix for CVE 2022-41032

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6912 advisory.

  - NuGet Client Elevation of Privilege Vulnerability. (CVE-2022-41032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6913 advisory.

  - NuGet Client Elevation of Privilege Vulnerability. (CVE-2022-41032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-7f5f9ede26 advisory.

    This is the October 2022 release of .NET Core 3.1

    This updates .NET Core 3.1 SDK to 3.1.424 and Runtime to 3.1.30.

    This includes fixes for CVE-2022-41032


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d80b1d2827 advisory.

    This is the monthly .NET 6 update for September 2022. It updates the .NET SDK to 6.0.109 and Runtime to     6.0.9.

    This includes a fix for CVE-2022-38013

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-f9ca76e479 advisory.

    This is the October 2022 release of .NET Core 3.1

    This updates .NET Core 3.1 SDK to 3.1.424 and Runtime to 3.1.30.

    This includes fixes for CVE-2022-41032

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8434 advisory.

    [7.0.100-0.5.rc2.0.1]
    - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier [Orabug: 34671152]

    [7.0.100-0.5.rc2]
    - Add lldb as a build dependency
    - Related: RHBZ#2134641

    [7.0.100-0.4.rc2]
    - Enable ppc64le builds
    - Related: RHBZ#2134641

    [7.0.100-0.3.rc2]
    - Update to .NET 7 RC 2
    - Resolves: RHBZ#2134641

    [7.0.100-0.2.rc1]
    - Update to .NET 7 RC 1
    - Enable s390x builds
    - Resolves: RHBZ#2123884

    [7.0.100-0.1]
    - Initial .NET 7 package
    - Resolves: RHBZ#2112027

    [6.0.105-1]
    - Update to .NET SDK 6.0.105 and Runtime 6.0.5

    [6.0.104-1]
    - Update to .NET SDK 6.0.104 and Runtime 6.0.4

    [6.0.103-1]
    - Update to .NET SDK 6.0.103 and Runtime 6.0.3

    [6.0.102-1]
    - Update to .NET SDK 6.0.102 and Runtime 6.0.2

    [6.0.101-3]
    - Update to .NET SDK 6.0.101 and Runtime 6.0.1

    [6.0.100-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

    [6.0.100-2]
    - Disable bootstrap

    [6.0.100-1]
    - Update to .NET 6

    [6.0.0-0.7.rc2]
    - Update to .NET 6 RC2

    [6.0.0-0.6.28be3e9a006d90d8c6e87d4353b77882829df718]
    - Enable building on arm64
    - Related: RHBZ#1986017

    [6.0.0-0.5.28be3e9a006d90d8c6e87d4353b77882829df718]
    - Enable building on s390x
    - Related: RHBZ#1986017

    [6.0.0-0.4.28be3e9a006d90d8c6e87d4353b77882829df718]
    - Clean up tarball and add initial support for s390x
    - Related: RHBZ#1986017

    [6.0.0-0.3.28be3e9a006d90d8c6e87d4353b77882829df718]
    - Update to work-in-progress RC2 release

    [6.0.0-0.2.preview6]
    - Updated to build the latest source-build preview

    [6.0.0-0.1.preview6]
    - Initial package for .NET 6

    [5.0.204-1]
    - Update to .NET SDK 5.0.204 and Runtime 5.0.7

    [5.0.203-1]
    - Update to .NET SDK 5.0.203 and Runtime 5.0.6

    [5.0.202-1]
    - Update to .NET SDK 5.0.202 and Runtime 5.0.5

    [5.0.104-2]
    - Mark files under /etc/ as config(noreplace)
    - Add an rpm-inspect configuration file
    - Add an rpmlintrc file
    - Enable gating for release branches and ELN too

    [5.0.104-1]
    - Update to .NET SDK 5.0.104 and Runtime 5.0.4
    - Drop unneeded/upstreamed patches

    [5.0.103-2]
    - Add Fedora 35 RIDs

    [5.0.103-1]
    - Update to .NET SDK 5.0.103 and Runtime 5.0.3

    [5.0.102-2]
    - Disable bootstrap

    [5.0.100-2]
    - Update to .NET Core Runtime 5.0.0 and SDK 5.0.100 commit 9c4e5de

    [5.0.100-1]
    - Update to .NET Core Runtime 5.0.0 and SDK 5.0.100

    [5.0.100-0.4.20201202git337413b]
    - Update to latest 5.0 pre-GA commit

    [5.0.100-0.4.20201123gitdee899c]
    - Update to 5.0 pre-GA commit

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8434 advisory.

  - NuGet Client Elevation of Privilege Vulnerability. (CVE-2022-41032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6911 advisory.

  - NuGet Client Elevation of Privilege Vulnerability. (CVE-2022-41032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7826 advisory.

    [7.0.100-0.4.rc2.0.1]
    - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier [Orabug: 34671152]

    [7.0.100-0.4.rc2]
    - Enable ppc64le builds
    - Related: RHBZ#2134642

    [7.0.100-0.3.rc2]
    - Update to .NET 7 RC 2
    - Resolves: RHBZ#2134642

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6913 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8434 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2.

    The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.100). (BZ#2134641)

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7826 advisory.

  - NuGet Client Elevation of Privilege Vulnerability. (CVE-2022-41032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7826 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2.

    The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.100). (BZ#2134642).

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update.
It is, therefore, affected by an escalation of privilege vulnerability. A local attacker can gain the privileges of the user running the Microsoft Visual Studio Application.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6911 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK  6.0.110 and .NET Runtime 6.0.10.

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6913 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK  6.0.110 and .NET Runtime 6.0.10.

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6914 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK  3.1.424  and .NET Runtime 3.1.30 .

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6915 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK  6.0.110 and .NET Runtime 6.0.10.

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6912 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK  3.1.424  and .NET Runtime 3.1.30.

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An elevation of privilege vulnerability exists in the Microsoft Visual Studio application installed on the host. A local attacker can gain the privileges of the user running the Microsoft Visual Studio application.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-6911 advisory.

    [6.0.110-1.0.1]
    - Add missing Oracle RIDs

    [6.0.110-1]
    - Update to .NET SDK 6.0.110 and Runtime 6.0.10
    - Resolves: RHBZ#2131327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-6913 advisory.

    [6.0.110-1.0.1]
    - Add missing Oracle RIDs
    - Build all packages on source-build even when in servicing

    [6.0.110-1]
    - Update to .NET SDK 6.0.110 and Runtime 6.0.10
    - Resolves: RHBZ#2131328

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-6912 advisory.

    [3.1.424-1.0.1]
    - Add missing Oracle Linux Runtime IDs

    [3.1.424-1]
    - Update to .NET SDK 3.1.424 and Runtime 3.1.30
    - Resolves: RHBZ#2131728

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A privilege escalation vulnerability exists in .NET core 6.0 < 6.0.10 and .NET Core 3.1 < 3.1.30. An authenticated, local attacker can exploit this, via the NuGet client, to cause the user to execute arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5670-1 advisory.

    Edward Thomson discovered that .NET 6 incorrectly handled permissions for local NuGet cache. A local     attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211330	Fedora 37 : dotnet6.0 (2022-2c37647a9c)	Nessus	Fedora Local Security Checks	high
184815	Rocky Linux 8 : .NET Core 3.1 (RLSA-2022:6912)	Nessus	Rocky Linux Local Security Checks	high
184663	Rocky Linux 9 : .NET 6.0 (RLSA-2022:6913)	Nessus	Rocky Linux Local Security Checks	high
169213	Fedora 35 : dotnet3.1 (2022-7f5f9ede26)	Nessus	Fedora Local Security Checks	high
169167	Fedora 36 : dotnet6.0 (2022-d80b1d2827)	Nessus	Fedora Local Security Checks	high
169060	Fedora 36 : dotnet3.1 (2022-f9ca76e479)	Nessus	Fedora Local Security Checks	high
168235	Oracle Linux 9 : dotnet7.0 (ELSA-2022-8434)	Nessus	Oracle Linux Local Security Checks	high
167833	AlmaLinux 9 : dotnet7.0 (ALSA-2022:8434)	Nessus	Alma Linux Local Security Checks	high
167824	Rocky Linux 8 : .NET 6.0 (RLSA-2022:6911)	Nessus	Rocky Linux Local Security Checks	high
167784	Oracle Linux 8 : dotnet7.0 (ELSA-2022-7826)	Nessus	Oracle Linux Local Security Checks	high
167717	AlmaLinux 9 : .NET 6.0 (ALSA-2022:6913)	Nessus	Alma Linux Local Security Checks	high
167645	RHEL 9 : dotnet7.0 (RHSA-2022:8434)	Nessus	Red Hat Local Security Checks	high
167443	AlmaLinux 8 : dotnet7.0 (ALSA-2022:7826)	Nessus	Alma Linux Local Security Checks	high
167086	RHEL 8 : dotnet7.0 (RHSA-2022:7826)	Nessus	Red Hat Local Security Checks	high
166329	Security Update for Visual Studio 2022 (Oct 2022) (macOS)	Nessus	MacOS X Local Security Checks	high
166152	RHEL 8 : .NET 6.0 (RHSA-2022:6911)	Nessus	Red Hat Local Security Checks	high
166151	RHEL 9 : .NET 6.0 (RHSA-2022:6913)	Nessus	Red Hat Local Security Checks	high
166150	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:6914)	Nessus	Red Hat Local Security Checks	high
166149	RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:6915)	Nessus	Red Hat Local Security Checks	high
166148	RHEL 8 : .NET Core 3.1 (RHSA-2022:6912)	Nessus	Red Hat Local Security Checks	high
166116	Security Updates for Microsoft Visual Studio Products (Oct 2022)	Nessus	Windows : Microsoft Bulletins	high
166104	Oracle Linux 8 : .NET / 6.0 (ELSA-2022-6911)	Nessus	Oracle Linux Local Security Checks	high
166090	Oracle Linux 9 : .NET / 6.0 (ELSA-2022-6913)	Nessus	Oracle Linux Local Security Checks	high
166067	Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2022-6912)	Nessus	Oracle Linux Local Security Checks	high
166054	Security Updates for Microsoft .NET Core (October 2022)	Nessus	Windows	high
166049	Ubuntu 22.04 LTS : .NET 6 vulnerability (USN-5670-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2022-41032

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high