[USN-6578-1] .NET vulnerabilities
[USN-6579-1] Xerces-C++ vulnerability
[USN-6560-2] OpenSSH vulnerabilities
[USN-6578-1] .NET vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6578-1
January 11, 2024
dotnet6, dotnet7, dotnet8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in dotnet6, dotnet7, and dotnet8.
Software Description:
- dotnet6: dotNET CLI tools and runtime
- dotnet7: dotNET CLI tools and runtime
- dotnet8: dotNET CLI tools and runtime
Details:
Vishal Mishra and Anita Gaud discovered that .NET did not properly
validate X.509 certificates with malformed signatures. An attacker
could possibly use this issue to bypass an application's typical
authentication logic. (CVE-2024-0057)
Morgan Brown discovered that .NET did not properly handle requests from
unauthenticated clients. An attacker could possibly use this issue to
cause a denial of service. (CVE-2024-21319)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
aspnetcore-runtime-6.0 6.0.126-0ubuntu1~23.10.1
aspnetcore-runtime-7.0 7.0.115-0ubuntu1~23.10.1
aspnetcore-runtime-8.0 8.0.1-0ubuntu1~23.10.1
dotnet-host 6.0.126-0ubuntu1~23.10.1
dotnet-host-7.0 7.0.115-0ubuntu1~23.10.1
dotnet-host-8.0 8.0.1-0ubuntu1~23.10.1
dotnet-hostfxr-6.0 6.0.126-0ubuntu1~23.10.1
dotnet-hostfxr-7.0 7.0.115-0ubuntu1~23.10.1
dotnet-hostfxr-8.0 8.0.1-0ubuntu1~23.10.1
dotnet-runtime-6.0 6.0.126-0ubuntu1~23.10.1
dotnet-runtime-7.0 7.0.115-0ubuntu1~23.10.1
dotnet-runtime-8.0 8.0.1-0ubuntu1~23.10.1
dotnet-sdk-6.0 6.0.126-0ubuntu1~23.10.1
dotnet-sdk-7.0 7.0.115-0ubuntu1~23.10.1
dotnet-sdk-8.0 8.0.101-0ubuntu1~23.10.1
dotnet6 6.0.126-0ubuntu1~23.10.1
dotnet7 7.0.115-0ubuntu1~23.10.1
dotnet8 8.0.101-8.0.1-0ubuntu1~23.10.1
Ubuntu 23.04:
aspnetcore-runtime-6.0 6.0.126-0ubuntu1~23.04.1
aspnetcore-runtime-7.0 7.0.115-0ubuntu1~23.04.1
dotnet-host 6.0.126-0ubuntu1~23.04.1
dotnet-host-7.0 7.0.115-0ubuntu1~23.04.1
dotnet-hostfxr-6.0 6.0.126-0ubuntu1~23.04.1
dotnet-hostfxr-7.0 7.0.115-0ubuntu1~23.04.1
dotnet-runtime-6.0 6.0.126-0ubuntu1~23.04.1
dotnet-runtime-7.0 7.0.115-0ubuntu1~23.04.1
dotnet-sdk-6.0 6.0.126-0ubuntu1~23.04.1
dotnet-sdk-7.0 7.0.115-0ubuntu1~23.04.1
dotnet6 6.0.126-0ubuntu1~23.04.1
dotnet7 7.0.115-0ubuntu1~23.04.1
Ubuntu 22.04 LTS:
aspnetcore-runtime-6.0 6.0.126-0ubuntu1~22.04.1
aspnetcore-runtime-7.0 7.0.115-0ubuntu1~22.04.1
dotnet-host 6.0.126-0ubuntu1~22.04.1
dotnet-host-7.0 7.0.115-0ubuntu1~22.04.1
dotnet-hostfxr-6.0 6.0.126-0ubuntu1~22.04.1
dotnet-hostfxr-7.0 7.0.115-0ubuntu1~22.04.1
dotnet-runtime-6.0 6.0.126-0ubuntu1~22.04.1
dotnet-runtime-7.0 7.0.115-0ubuntu1~22.04.1
dotnet-sdk-6.0 6.0.126-0ubuntu1~22.04.1
dotnet-sdk-7.0 7.0.115-0ubuntu1~22.04.1
dotnet6 6.0.126-0ubuntu1~22.04.1
dotnet7 7.0.115-0ubuntu1~22.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6578-1
CVE-2024-0057, CVE-2024-21319
Package Information:
https://launchpad.net/ubuntu/+source/dotnet6/6.0.126-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.115-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.101-8.0.1-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.126-0ubuntu1~23.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.115-0ubuntu1~23.04.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.126-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.115-0ubuntu1~22.04.1
[USN-6579-1] Xerces-C++ vulnerability
==========================================================================
Ubuntu Security Notice USN-6579-1
January 11, 2024
xerces-c vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Xerces-C++ could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- xerces-c: Validating XML parser written in a portable subset of C++
Details:
It was discovered that Xerces-C++ was not properly handling memory
management operations when parsing XML data containing external DTDs,
which could trigger a use-after-free error. If a user or automated system
were tricked into processing a specially crafted XML document, an attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libxerces-c-samples 3.2.0+debian-2ubuntu0.1~esm2
libxerces-c3.2 3.2.0+debian-2ubuntu0.1~esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libxerces-c-samples 3.1.3+debian-1ubuntu0.1~esm2
libxerces-c3.1 3.1.3+debian-1ubuntu0.1~esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libxerces-c-samples 3.1.1-5.1+deb8u4ubuntu0.1~esm1
libxerces-c3.1 3.1.1-5.1+deb8u4ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6579-1
CVE-2018-1311
[USN-6560-2] OpenSSH vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6560-2
January 11, 2024
openssh vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in OpenSSH.
Software Description:
- openssh: secure shell (SSH) for secure access to remote machines
Details:
USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
protocol was vulnerable to a prefix truncation attack. If a remote attacker
was able to intercept SSH communications, extension negotiation messages
could be truncated, possibly leading to certain algorithms and features
being downgraded. This issue is known as the Terrapin attack. This update
adds protocol extensions to mitigate this issue. (CVE-2023-48795)
It was discovered that OpenSSH incorrectly handled user names or host names
with shell metacharacters. An attacker could possibly use this issue to
perform OS command injection. This only affected Ubuntu 18.04 LTS. (CVE-2023-51385)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
openssh-client 1:7.6p1-4ubuntu0.7+esm3
openssh-server 1:7.6p1-4ubuntu0.7+esm3
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
openssh-client 1:7.2p2-4ubuntu2.10+esm5
openssh-server 1:7.2p2-4ubuntu2.10+esm5
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6560-2
https://ubuntu.com/security/notices/USN-6560-1
CVE-2023-48795, CVE-2023-51385
