Vulnerability · Published Jan 9, 2024 · Assigned by microsoft

CVE-2024-0057NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Critical 9.1

In plain English

A critical-severity improper input validation in Microsoft .NET Framework 2.0 Service Pack 2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.8%top 13.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aspnetcore-runtime-6.0	6.0.26-1.el8_9	ALSA-2024:0158
AlmaLinux:9	aspnetcore-runtime-6.0	6.0.26-1.el9_3	ALSA-2024:0156
AlmaLinux:8	aspnetcore-runtime-7.0	7.0.15-1.el8_9	ALSA-2024:0157
AlmaLinux:9	aspnetcore-runtime-7.0	7.0.15-1.el9_3	ALSA-2024:0151
AlmaLinux:8	aspnetcore-runtime-8.0	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	aspnetcore-runtime-8.0	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	aspnetcore-targeting-pack-6.0	6.0.26-1.el8_9	ALSA-2024:0158
AlmaLinux:9	aspnetcore-targeting-pack-6.0	6.0.26-1.el9_3	ALSA-2024:0156
AlmaLinux:8	aspnetcore-targeting-pack-7.0	7.0.15-1.el8_9	ALSA-2024:0157
AlmaLinux:9	aspnetcore-targeting-pack-7.0	7.0.15-1.el9_3	ALSA-2024:0151
AlmaLinux:8	aspnetcore-targeting-pack-8.0	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	aspnetcore-targeting-pack-8.0	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet	8.0.101-1.el8_9	ALSA-2024:0150
AlmaLinux:8	dotnet-apphost-pack-6.0	6.0.26-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-apphost-pack-6.0	6.0.26-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-apphost-pack-7.0	7.0.15-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-apphost-pack-7.0	7.0.15-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-apphost-pack-8.0	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-apphost-pack-8.0	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-host	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-host	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-hostfxr-6.0	6.0.26-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-hostfxr-6.0	6.0.26-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-hostfxr-7.0	7.0.15-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-hostfxr-7.0	7.0.15-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-hostfxr-8.0	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-hostfxr-8.0	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-runtime-6.0	6.0.26-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-runtime-6.0	6.0.26-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-runtime-7.0	7.0.15-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-runtime-7.0	7.0.15-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-runtime-8.0	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-runtime-8.0	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-sdk-6.0	6.0.126-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-sdk-6.0	6.0.126-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-sdk-6.0-source-built-artifacts	6.0.126-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-sdk-6.0-source-built-artifacts	6.0.126-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-sdk-7.0	7.0.115-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-sdk-7.0	7.0.115-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-sdk-7.0-source-built-artifacts	7.0.115-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-sdk-7.0-source-built-artifacts	7.0.115-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-sdk-8.0	8.0.101-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-sdk-8.0	8.0.101-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-sdk-8.0-source-built-artifacts	8.0.101-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-sdk-8.0-source-built-artifacts	8.0.101-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-targeting-pack-6.0	6.0.26-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-targeting-pack-6.0	6.0.26-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-targeting-pack-7.0	7.0.15-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-targeting-pack-7.0	7.0.15-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-targeting-pack-8.0	8.0.1-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-targeting-pack-8.0	8.0.1-1.el9_3	ALSA-2024:0152
AlmaLinux:8	dotnet-templates-6.0	6.0.126-1.el8_9	ALSA-2024:0158
AlmaLinux:9	dotnet-templates-6.0	6.0.126-1.el9_3	ALSA-2024:0156
AlmaLinux:8	dotnet-templates-7.0	7.0.115-1.el8_9	ALSA-2024:0157
AlmaLinux:9	dotnet-templates-7.0	7.0.115-1.el9_3	ALSA-2024:0151
AlmaLinux:8	dotnet-templates-8.0	8.0.101-1.el8_9	ALSA-2024:0150
AlmaLinux:9	dotnet-templates-8.0	8.0.101-1.el9_3	ALSA-2024:0152
AlmaLinux:8	netstandard-targeting-pack-2.1	8.0.101-1.el8_9	ALSA-2024:0150
AlmaLinux:9	netstandard-targeting-pack-2.1	8.0.101-1.el9_3	ALSA-2024:0152
Alpine:v3.20	dotnet6-build	6.0.126-r0	ALPINE-CVE-2024-0057
Alpine:v3.20	dotnet6-runtime	6.0.26-r0	ALPINE-CVE-2024-0057
NuGet	nuget.commandline	6.0.6	GHSA-68w7-72jg-6qpp
NuGet	nuget.commandline	5.11.6	GHSA-68w7-72jg-6qpp
NuGet	nuget.commandline	6.3.4	GHSA-68w7-72jg-6qpp
NuGet	nuget.commandline	6.4.3	GHSA-68w7-72jg-6qpp
NuGet	nuget.commandline	6.6.2	GHSA-68w7-72jg-6qpp
NuGet	nuget.commandline	6.7.1	GHSA-68w7-72jg-6qpp
NuGet	nuget.commandline	6.8.1	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	5.11.6	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	6.0.6	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	6.7.1	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	6.3.4	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	6.4.3	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	6.8.1	GHSA-68w7-72jg-6qpp
NuGet	nuget.packaging	6.6.2	GHSA-68w7-72jg-6qpp
Rocky Linux:8	dotnet6.0	0:6.0.126-1.el8_9	RLSA-2024:0158
Rocky Linux:8	dotnet7.0	0:7.0.115-1.el8_9	RLSA-2024:0157
Rocky Linux:8	dotnet8.0	0:8.0.101-1.el8_9	RLSA-2024:0150
Ubuntu:22.04:LTS	dotnet6	6.0.126-0ubuntu1~22.04.1	USN-6578-1
Ubuntu:22.04:LTS	dotnet6	6.0.126-0ubuntu1~22.04.1	UBUNTU-CVE-2024-0057
Ubuntu:22.04:LTS	dotnet7	7.0.115-0ubuntu1~22.04.1	USN-6578-1
Ubuntu:22.04:LTS	dotnet7	7.0.115-0ubuntu1~22.04.1	UBUNTU-CVE-2024-0057

Affected products (as reported)

Vendor	Product	Versions
Microsoft	.NET 8.0	8.0 – before 8.0.1
Microsoft	.NET 7.0	7.0.0 – before 7.0.15
Microsoft	.NET 6.0	6.0.0 – before 6.0.26
Microsoft	Microsoft Visual Studio 2022 version 17.2	17.2.0 – before 17.2.23
Microsoft	Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)	16.11.0 – before 16.11.34
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0 – before 17.4.15
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0 – before 17.6.11
Microsoft	Microsoft Visual Studio 2022 version 17.8	17.8.0 – before 17.8.4
Microsoft	NuGet 5.11.0	5.11.0 – before 5.11.6.0
Microsoft	NuGet 17.4.0	17.4.0 – before 17.4.3.0
Microsoft	NUGET 17.6.0	17.6.0 – before 17.6.2.0
Microsoft	NuGet 17.8.0	17.8.0 – before 17.8.1.0
Microsoft	PowerShell 7.2	7.2.0 – before 7.2.18
Microsoft	PowerShell 7.3	7.3.0 – before 7.3.11
Microsoft	PowerShell 7.4	7.4.0 – before 7.4.2
Microsoft	Microsoft .NET Framework 4.8	4.8.0 – before 4.8.04690.02
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 – before 4.8.04690.02
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 – before 4.7.04081.03
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 – before 4.7.04081.02
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 – before 4.8.09214.01
Microsoft	Microsoft .NET Framework 2.0 Service Pack 2	2.0.0 – before 3.0.50727.8976
Microsoft	Microsoft .NET Framework 3.0 Service Pack 2	3.0.0 – before 3.0.50727.8976

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C

References

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability vendor-advisory
https://security.netapp.com/advisory/ntap-20240208-0007/ x_transferred