Bug 2221854 (CVE-2023-33170) - CVE-2023-33170 dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method
Summary: CVE-2023-33170 dotnet: race condition in Core SignInManager<TUser> PasswordSi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-33170
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2222059 2222060 2222061 2222062 2222063 2222064 2222065 2222066 2222067 2222068 2222069 2222071 2222072
Blocks: 2221855
TreeView+ depends on / blocked
 
Reported: 2023-07-11 05:28 UTC by TEJ RATHI
Modified: 2023-08-03 07:54 UTC (History)
8 users (show)

Fixed In Version: dotnet 6.0.20, dotnet 7.0.9
Clone Of:
Environment:
Last Closed: 2023-07-13 13:41:44 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4057 0 None None None 2023-07-13 08:38:51 UTC
Red Hat Product Errata RHSA-2023:4058 0 None None None 2023-07-13 08:37:20 UTC
Red Hat Product Errata RHSA-2023:4059 0 None None None 2023-07-13 08:37:28 UTC
Red Hat Product Errata RHSA-2023:4060 0 None None None 2023-07-13 08:46:35 UTC
Red Hat Product Errata RHSA-2023:4061 0 None None None 2023-07-13 08:41:52 UTC
Red Hat Product Errata RHSA-2023:4448 0 None None None 2023-08-03 07:54:55 UTC
Red Hat Product Errata RHSA-2023:4449 0 None None None 2023-08-03 07:53:56 UTC

Description TEJ RATHI 2023-07-11 05:28:19 UTC 
CVE-2023-33170 - Security Feature Bypass - Race Condition in ASP.NET Core SignInManager<TUser> PasswordSignInAsync Method.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170
Comment 1 TEJ RATHI 2023-07-11 16:42:51 UTC 
The CVE is public now:
https://github.com/dotnet/core/blob/7cc69f36461a2aefe4c29acb46d6816cd741a8a3/release-notes/7.0/7.0.9/7.0.9.md#notable-changes
Comment 3 TEJ RATHI 2023-07-11 18:02:09 UTC 
Created dotnet6.0 tracking bugs for this issue:

Affects: fedora-all [bug 2222071]


Created dotnet7.0 tracking bugs for this issue:

Affects: fedora-all [bug 2222072]
Comment 4 TEJ RATHI 2023-07-12 06:27:18 UTC 
References: 
https://devblogs.microsoft.com/dotnet/july-2023-updates/
https://github.com/advisories/GHSA-25c8-p796-jg6r
https://github.com/dotnet/announcements/issues/264
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170
Comment 5 errata-xmlrpc 2023-07-13 08:37:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4058 https://access.redhat.com/errata/RHSA-2023:4058
Comment 6 errata-xmlrpc 2023-07-13 08:37:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4059 https://access.redhat.com/errata/RHSA-2023:4059
Comment 7 errata-xmlrpc 2023-07-13 08:38:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4057 https://access.redhat.com/errata/RHSA-2023:4057
Comment 8 errata-xmlrpc 2023-07-13 08:41:51 UTC 
This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2023:4061 https://access.redhat.com/errata/RHSA-2023:4061
Comment 9 errata-xmlrpc 2023-07-13 08:46:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4060 https://access.redhat.com/errata/RHSA-2023:4060
Comment 10 Product Security DevOps Team 2023-07-13 13:41:42 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-33170
Comment 11 errata-xmlrpc 2023-08-03 07:53:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4449 https://access.redhat.com/errata/RHSA-2023:4449
Comment 12 errata-xmlrpc 2023-08-03 07:54:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4448 https://access.redhat.com/errata/RHSA-2023:4448
Note You need to log in before you can comment on or make changes to this bug.