Bug 2132614 (CVE-2022-41032)

Summary:	CVE-2022-41032 dotnet: Nuget cache poisoning on Linux via world-writable cache directory
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	andrew.slice, bodavis, crummel, dbhole, domme, dotnet-packagers, francisco.vergarat, harold, kanderso, lvaleeva, omajid, rwagner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in dotnet. This flaw allows an attacker to triage a NuGet cache poisoning on Linux via a world-writable cache directory.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-07 04:17:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2132622, 2132625, 2132628, 2132631, 2132615, 2132616, 2132617, 2132618, 2132619, 2132620, 2132621, 2132623, 2132624, 2132626, 2132627, 2132629, 2132630, 2133873, 2133874, 2133875, 2140665, 2141968, 2141971
Bug Blocks:	2132102

Description Sandipan Roy 2022-10-06 09:14:40 UTC

Nuget cache poisoning on Linux / macOS via world-writable cache directory.

Comment 2 Guilherme de Almeida Suckevicz 2022-10-11 17:22:06 UTC

Created dotnet3.1 tracking bugs for this issue:

Affects: fedora-all [bug 2133874]


Created dotnet5.0 tracking bugs for this issue:

Affects: fedora-all [bug 2133873]


Created dotnet6.0 tracking bugs for this issue:

Affects: fedora-all [bug 2133875]

Comment 3 errata-xmlrpc 2022-10-12 07:55:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:6913 https://access.redhat.com/errata/RHSA-2022:6913

Comment 4 errata-xmlrpc 2022-10-12 07:58:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:6912 https://access.redhat.com/errata/RHSA-2022:6912

Comment 5 errata-xmlrpc 2022-10-12 08:00:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:6911 https://access.redhat.com/errata/RHSA-2022:6911

Comment 6 errata-xmlrpc 2022-10-12 08:03:46 UTC

This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2022:6914 https://access.redhat.com/errata/RHSA-2022:6914

Comment 7 errata-xmlrpc 2022-10-12 08:19:22 UTC

This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2022:6915 https://access.redhat.com/errata/RHSA-2022:6915

Comment 9 errata-xmlrpc 2022-11-08 11:31:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7826 https://access.redhat.com/errata/RHSA-2022:7826

Comment 12 errata-xmlrpc 2022-11-15 15:59:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8434 https://access.redhat.com/errata/RHSA-2022:8434

Comment 13 Product Security DevOps Team 2022-12-07 04:17:33 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41032