Bug 2228621 (CVE-2023-38180) - CVE-2023-38180 dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack
Summary: CVE-2023-38180 dotnet: Kestrel vulnerability to slow read attacks leading to ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-38180
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2228883 2228884 2228885 2228886 2228887 2228894 2228895 2228896 2228897 2228898 2230090 2230091 2231093 2231094
Blocks: 2228616
TreeView+ depends on / blocked
 
Reported: 2023-08-02 20:54 UTC by Patrick Del Bello
Modified: 2023-08-15 01:15 UTC (History)
9 users (show)

Fixed In Version: .NET SDK 6.0.121, .NET SDK 7.0.110, .NET Runtime 6.0.21, .NET Runtime 7.0.10
Doc Type: If docs needed, set a value
Doc Text:
An uncontrolled resource consumption vulnerability was found in the Kestrel component of the dotNET. When detecting a potentially malicious client, Kestrel will sometimes fail to disconnect it, resulting in denial of service.
Clone Of:
Environment:
Last Closed: 2023-08-14 19:19:39 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:4652 0 None None None 2023-08-15 01:04:18 UTC
Red Hat Product Errata RHBA-2023:4653 0 None None None 2023-08-15 01:15:48 UTC
Red Hat Product Errata RHSA-2023:4639 0 None None None 2023-08-14 14:32:25 UTC
Red Hat Product Errata RHSA-2023:4640 0 None None None 2023-08-14 14:40:18 UTC
Red Hat Product Errata RHSA-2023:4641 0 None None None 2023-08-14 14:44:22 UTC
Red Hat Product Errata RHSA-2023:4642 0 None None None 2023-08-14 14:46:23 UTC
Red Hat Product Errata RHSA-2023:4643 0 None None None 2023-08-14 14:55:51 UTC
Red Hat Product Errata RHSA-2023:4644 0 None None None 2023-08-14 14:46:17 UTC
Red Hat Product Errata RHSA-2023:4645 0 None None None 2023-08-14 14:55:48 UTC

Description Patrick Del Bello 2023-08-02 20:54:15 UTC 
Denial of Service: Kestrel vulnerability to slow read attacks
Comment 3 Sandipan Roy 2023-08-08 17:19:17 UTC 
Created dotnet6.0 tracking bugs for this issue:

Affects: fedora-all [bug 2230090]


Created dotnet7.0 tracking bugs for this issue:

Affects: fedora-all [bug 2230091]
Comment 8 TEJ RATHI 2023-08-10 15:57:44 UTC 
References:
https://devblogs.microsoft.com/dotnet/august-2023-updates/
https://github.com/advisories/GHSA-vmch-3w2x-vhgq
https://github.com/dotnet/announcements/issues/269
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180
Comment 9 errata-xmlrpc 2023-08-14 14:32:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4639 https://access.redhat.com/errata/RHSA-2023:4639
Comment 10 errata-xmlrpc 2023-08-14 14:40:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4640 https://access.redhat.com/errata/RHSA-2023:4640
Comment 11 errata-xmlrpc 2023-08-14 14:44:21 UTC 
This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2023:4641 https://access.redhat.com/errata/RHSA-2023:4641
Comment 12 errata-xmlrpc 2023-08-14 14:46:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4642 https://access.redhat.com/errata/RHSA-2023:4642
Comment 13 errata-xmlrpc 2023-08-14 14:46:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4644 https://access.redhat.com/errata/RHSA-2023:4644
Comment 14 errata-xmlrpc 2023-08-14 14:55:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4645 https://access.redhat.com/errata/RHSA-2023:4645
Comment 15 errata-xmlrpc 2023-08-14 14:55:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4643 https://access.redhat.com/errata/RHSA-2023:4643
Comment 16 Product Security DevOps Team 2023-08-14 19:19:37 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-38180
Note You need to log in before you can comment on or make changes to this bug.