Movatterモバイル変換


[0]ホーム

URL:


Homepage

CVE-2025-24070 Affectingdotnet-hostfxr-8.0 package, versions<0:8.0.14-1.el9_5


Severity

Recommended
0.0
high
0
10

Based on AlmaLinux security rating.

Threat Intelligence

EPSS

The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSSdocumentation for more details.

0.12% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX9-DOTNETHOSTFXR80-9480541
  • published19 Mar 2025
  • disclosed11 Mar 2025

Introduced: 11 Mar 2025

CVE-2025-24070  (opens in a new tab)
Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
CWE-1390  (opens in a new tab)
Common Weakness Enumeration (CWE) is a category system for software weaknesses

How to fix?

UpgradeAlmaLinux:9dotnet-hostfxr-8.0 to version 0:8.0.14-1.el9_5 or higher.
This issue was patched inALSA-2025:2669.

NVD Description

Note:Versions mentioned in the description apply only to the upstreamdotnet-hostfxr-8.0 package and not thedotnet-hostfxr-8.0 package as distributed byAlmaLinux.SeeHow to fix? forAlmaLinux:9 relevant fixed versions and status.

Weak authentication in ASP.NET Core &amp; Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVSS Base Scores

version 3.1

NVD

7 high
  • Attack Vector (AV)

    The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitableat the protocol level one or more network hops away (e.g., across one or more routers).

    Network
  • Attack Complexity (AC)

    A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

    High
  • Privileges Required (PR)

    The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.

    None
  • User Interaction (UI)

    The vulnerable system can be exploited without interaction from any user.

    None
  • Scope (S)

    An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

    Unchanged
  • Confidentiality (C)

    There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.

    Low
  • Integrity (I)

    Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.

    Low
  • Availability (A)

    There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

    High
                                           

[8]ページ先頭

©2009-2025 Movatter.jp