Bug 2221854 (CVE-2023-33170) - CVE-2023-33170 dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method
Summary: CVE-2023-33170 dotnet: race condition in Core SignInManager<TUser> PasswordSi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-33170
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2222059 2222060 2222061 2222062 2222063 2222064 2222065 2222066 2222067 2222068 2222069 2222071 2222072
Blocks: 2221855
TreeView+ depends on / blocked
 
Reported: 2023-07-11 05:28 UTC by TEJ RATHI
Modified: 2023-08-03 07:54 UTC (History)
8 users (show)

Fixed In Version: dotnet 6.0.20, dotnet 7.0.9
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on confidentiality, integrity, and availability.
Clone Of:
Environment:
Last Closed: 2023-07-13 13:41:44 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4057 0 None None None 2023-07-13 08:38:51 UTC
Red Hat Product Errata RHSA-2023:4058 0 None None None 2023-07-13 08:37:20 UTC
Red Hat Product Errata RHSA-2023:4059 0 None None None 2023-07-13 08:37:28 UTC
Red Hat Product Errata RHSA-2023:4060 0 None None None 2023-07-13 08:46:35 UTC
Red Hat Product Errata RHSA-2023:4061 0 None None None 2023-07-13 08:41:52 UTC
Red Hat Product Errata RHSA-2023:4448 0 None None None 2023-08-03 07:54:55 UTC
Red Hat Product Errata RHSA-2023:4449 0 None None None 2023-08-03 07:53:56 UTC

Description TEJ RATHI 2023-07-11 05:28:19 UTC 
CVE-2023-33170 - Security Feature Bypass - Race Condition in ASP.NET Core SignInManager<TUser> PasswordSignInAsync Method.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170
Comment 1 TEJ RATHI 2023-07-11 16:42:51 UTC 
The CVE is public now:
https://github.com/dotnet/core/blob/7cc69f36461a2aefe4c29acb46d6816cd741a8a3/release-notes/7.0/7.0.9/7.0.9.md#notable-changes
Comment 3 TEJ RATHI 2023-07-11 18:02:09 UTC 
Created dotnet6.0 tracking bugs for this issue:

Affects: fedora-all [bug 2222071]


Created dotnet7.0 tracking bugs for this issue:

Affects: fedora-all [bug 2222072]
Comment 4 TEJ RATHI 2023-07-12 06:27:18 UTC 
References: 
https://devblogs.microsoft.com/dotnet/july-2023-updates/
https://github.com/advisories/GHSA-25c8-p796-jg6r
https://github.com/dotnet/announcements/issues/264
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170
Comment 5 errata-xmlrpc 2023-07-13 08:37:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4058 https://access.redhat.com/errata/RHSA-2023:4058
Comment 6 errata-xmlrpc 2023-07-13 08:37:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4059 https://access.redhat.com/errata/RHSA-2023:4059
Comment 7 errata-xmlrpc 2023-07-13 08:38:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4057 https://access.redhat.com/errata/RHSA-2023:4057
Comment 8 errata-xmlrpc 2023-07-13 08:41:51 UTC 
This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2023:4061 https://access.redhat.com/errata/RHSA-2023:4061
Comment 9 errata-xmlrpc 2023-07-13 08:46:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4060 https://access.redhat.com/errata/RHSA-2023:4060
Comment 10 Product Security DevOps Team 2023-07-13 13:41:42 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-33170
Comment 11 errata-xmlrpc 2023-08-03 07:53:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4449 https://access.redhat.com/errata/RHSA-2023:4449
Comment 12 errata-xmlrpc 2023-08-03 07:54:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4448 https://access.redhat.com/errata/RHSA-2023:4448
Note You need to log in before you can comment on or make changes to this bug.