.NET and Visual Studio Information Disclosure Vulnerability

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f4eb809b49 advisory.

    This is the August 2024 monthly update for .NET 8. This includes a fix for CVE-2024-38167

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.8/8.0.108.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.8/8.0.8.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8eff1bffb1 advisory.

    This is the August 2024 monthly update for .NET 8. This includes a fix for CVE-2024-38167

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.8/8.0.108.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.8/8.0.8.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5334 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.108 and .NET Runtime 8.0.8.

    Security Fix(es):

    * dotnet: Information disclosure vulnerability in TlsStream (CVE-2024-38167)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * EMBARGOED CVE-2024-38167 dotnet8.0: Information disclosure vulnerability in TlsStream (CVE-2024-38167)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - .NET and Visual Studio Information Disclosure Vulnerability. (CVE-2024-38167)   
  - .NET Core and Visual Studio Denial of Service Vulnerability. (CVE-2024-38168)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-5337 advisory.

    [8.0.108-1.0.1]
    - Add support for Oracle Linux

    [8.0.108-1]
    - Update to .NET SDK 8.0.108 and Runtime 8.0.8
    - Resolves: RHEL-52388

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5337 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.108 and .NET Runtime 8.0.8.

    Security Fix(es):

    * dotnet: Information disclosure vulnerability in TlsStream (CVE-2024-38167)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * EMBARGOED CVE-2024-38167 dotnet8.0: Information disclosure vulnerability in TlsStream (CVE-2024-38167)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-5334 advisory.

    [8.0.108-1.0.1]
    - Add support for Oracle Linux

    [8.0.108-1]
    - Update to .NET SDK 8.0.108 and Runtime 8.0.8
    - Resolves: RHEL-52389

    [8.0.107-2]
    - Fix ownership of some missed directories
    - Resolves: RHEL-47080

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6959-1 advisory.

    It was discovered that .NET suffered from an information disclosure vulnerability. An attacker could     potentially use this issue to read targeted email messages.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - .NET and Visual Studio Information Disclosure Vulnerability (CVE-2024-38167)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-38168)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206237	Fedora 40 : dotnet8.0 (2024-f4eb809b49)	Nessus	Fedora Local Security Checks	medium
206223	Fedora 39 : dotnet8.0 (2024-8eff1bffb1)	Nessus	Fedora Local Security Checks	medium
205634	RHEL 9 : .NET 8.0 (RHSA-2024:5334)	Nessus	Red Hat Local Security Checks	medium
205591	Security Updates for Microsoft Visual Studio Products (August 2024)	Nessus	Windows : Microsoft Bulletins	medium
205539	Oracle Linux 8 : .NET / 8.0 (ELSA-2024-5337)	Nessus	Oracle Linux Local Security Checks	medium
205497	RHEL 8 : .NET 8.0 (RHSA-2024:5337)	Nessus	Red Hat Local Security Checks	medium
205491	Oracle Linux 9 : .NET / 8.0 (ELSA-2024-5334)	Nessus	Oracle Linux Local Security Checks	medium
205481	Ubuntu 22.04 LTS / 24.04 LTS : .NET vulnerability (USN-6959-1)	Nessus	Ubuntu Local Security Checks	medium
205451	Security Update for Microsoft .NET Core (August 2024)	Nessus	Windows	medium

Detections

Analytics

CVE-2024-38167

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium