Vulnerability · Published Jun 14, 2023 · Assigned by microsoft

CVE-2023-29331.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Microsoft .NET Framework 2.0 Service Pack 2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aspnetcore-runtime-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	aspnetcore-runtime-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	aspnetcore-runtime-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	aspnetcore-runtime-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	aspnetcore-targeting-pack-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	aspnetcore-targeting-pack-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	aspnetcore-targeting-pack-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	aspnetcore-targeting-pack-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:8	dotnet-apphost-pack-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-apphost-pack-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-apphost-pack-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-apphost-pack-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-host	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-host	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-hostfxr-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-hostfxr-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-hostfxr-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-hostfxr-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-runtime-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-runtime-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-runtime-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-runtime-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-sdk-6.0	6.0.118-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-sdk-6.0	6.0.118-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-sdk-6.0-source-built-artifacts	6.0.118-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-sdk-6.0-source-built-artifacts	6.0.118-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-sdk-7.0	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-sdk-7.0	7.0.107-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-sdk-7.0-source-built-artifacts	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-sdk-7.0-source-built-artifacts	7.0.107-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-targeting-pack-6.0	6.0.18-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-targeting-pack-6.0	6.0.18-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-targeting-pack-7.0	7.0.7-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-targeting-pack-7.0	7.0.7-1.el9_2	ALSA-2023:3592
AlmaLinux:8	dotnet-templates-6.0	6.0.118-1.el8_8	ALSA-2023:3582
AlmaLinux:9	dotnet-templates-6.0	6.0.118-1.el9_2	ALSA-2023:3581
AlmaLinux:8	dotnet-templates-7.0	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	dotnet-templates-7.0	7.0.107-1.el9_2	ALSA-2023:3592
AlmaLinux:8	netstandard-targeting-pack-2.1	7.0.107-1.el8_8	ALSA-2023:3593
AlmaLinux:9	netstandard-targeting-pack-2.1	7.0.107-1.el9_2	ALSA-2023:3592
Alpine:v3.20	dotnet6-build	6.0.118-r0	ALPINE-CVE-2023-29331
Alpine:v3.20	dotnet6-runtime	6.0.18-r0	ALPINE-CVE-2023-29331
NuGet	microsoft.netcore.app.runtime.linux-arm	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-arm	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-arm64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-arm64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-musl-arm	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-musl-arm	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-musl-arm64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-musl-arm64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-musl-x64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-musl-x64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-x64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.linux-x64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.osx-arm64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.osx-arm64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.osx-x64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.osx-x64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-arm	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-arm	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-arm64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-arm64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-x64	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-x64	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-x86	6.0.18	GHSA-555c-2p6r-68mm
NuGet	microsoft.netcore.app.runtime.win-x86	7.0.7	GHSA-555c-2p6r-68mm
NuGet	microsoft.windows.compatibility	7.0.3	GHSA-555c-2p6r-68mm
NuGet	microsoft.windows.compatibility	6.0.6	GHSA-555c-2p6r-68mm
NuGet	system.security.cryptography.pkcs	6.0.3	GHSA-555c-2p6r-68mm
NuGet	system.security.cryptography.pkcs	7.0.2	GHSA-555c-2p6r-68mm
Rocky Linux:8	dotnet6.0	0:6.0.118-1.el8_8	RLSA-2023:3582
Rocky Linux:8	dotnet7.0	0:7.0.107-1.el8_8	RLSA-2023:3593
Ubuntu:22.04:LTS	dotnet6	6.0.118-0ubuntu1~22.04.1	USN-6161-1
Ubuntu:22.04:LTS	dotnet6	6.0.118-0ubuntu1~22.04.1	UBUNTU-CVE-2023-29331
Ubuntu:22.04:LTS	dotnet7	7.0.107-0ubuntu1~22.04.1	UBUNTU-CVE-2023-29331
Ubuntu:22.04:LTS	dotnet7	7.0.107-0ubuntu1~22.04.1	USN-6161-1

Affected products (as reported)

Vendor	Product	Versions
Microsoft	.NET 6.0	6.0.0 – before 6.0.18
Microsoft	.NET 7.0	7.0.0 – before 7.0.7
Microsoft	Microsoft Visual Studio 2022 version 17.0	17.0.0 – before 17.0.22
Microsoft	Microsoft Visual Studio 2022 version 17.2	17.2.0 – before 17.2.16
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0 – before 17.4.8
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0 – before 17.6.3
Microsoft	PowerShell 7.2	7.2.0 – before 7.2.12
Microsoft	PowerShell 7.3	7.3.0 – before 7.3.5
Microsoft	Microsoft .NET Framework 4.8	4.8.0 – before 4.8.4644.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 – before 4.8.4644.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 – before 4.7.4050.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	3.0.0.0 – before 10.0.14393.5989
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 – before 4.7.04043.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 – before 4.8.9166.0
Microsoft	Microsoft .NET Framework 4.6.2	4.7.0 – before 4.7.04043.0
Microsoft	Microsoft .NET Framework 3.5 and 4.6.2	4.7.0 – before 10.0.10240.19983
Microsoft	Microsoft .NET Framework 2.0 Service Pack 2	2.0.0 – before 3.0.6920.8954; 2.0.50727.8970
Microsoft	Microsoft .NET Framework 3.0 Service Pack 2	3.0.0 – before 3.0.6920.8954; 2.0.50727.8970
Microsoft	Microsoft .NET Framework 3.5	3.5.0 – before 3.0.6920.8954; 2.0.50727.8970
Microsoft	Microsoft .NET Framework 3.5.1	3.5.0 – before 3.0.6920.8954; 2.0.50727.8970

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

References

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability vendor-advisory