CVE-2023-33170 - Security Feature Bypass - Race Condition in ASP.NET Core SignInManager<TUser> PasswordSignInAsync Method. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170
The CVE is public now: https://github.com/dotnet/core/blob/7cc69f36461a2aefe4c29acb46d6816cd741a8a3/release-notes/7.0/7.0.9/7.0.9.md#notable-changes
Created dotnet6.0 tracking bugs for this issue: Affects: fedora-all [bug 2222071] Created dotnet7.0 tracking bugs for this issue: Affects: fedora-all [bug 2222072]
References: https://devblogs.microsoft.com/dotnet/july-2023-updates/ https://github.com/advisories/GHSA-25c8-p796-jg6r https://github.com/dotnet/announcements/issues/264 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:4058 https://access.redhat.com/errata/RHSA-2023:4058
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:4059 https://access.redhat.com/errata/RHSA-2023:4059
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:4057 https://access.redhat.com/errata/RHSA-2023:4057
This issue has been addressed in the following products: .NET Core on Red Hat Enterprise Linux Via RHSA-2023:4061 https://access.redhat.com/errata/RHSA-2023:4061
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:4060 https://access.redhat.com/errata/RHSA-2023:4060
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-33170
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:4449 https://access.redhat.com/errata/RHSA-2023:4449
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:4448 https://access.redhat.com/errata/RHSA-2023:4448