1

I am trying to understand under which circumstances CVE-2024-38095 applies. When reading the advisory (https://github.com/dotnet/runtime/security/advisories/GHSA-447r-wph3-92pm), one finds the following statements:

  • Affected software: Any .NET 8.0 application running on .NET 8.0.6 or earlier.
  • The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below
    • Affected Packages: System.Formats.Asn1 < 8.0.1 (shortened)
  • If you have a runtime or SDK with a version listed, or an affected package listed in affected software or affected packages, you're exposed to the vulnerability.
  • To fix the issue please install the latest version of .NET 8.0 or .NET 7.0 or .NET 6.0

These statements seem to contradict each other at least a bit. On the one hand, they say if using an old .Net SDK OR the package one is vulnerable, on the other hand the fix only suggests to update the SDK itself.

Why I am trying to understand is: Which combinations of the .Net SDK and System.Formats.Asn1 are vulnerable. For example, if I follow the suggested fix and use a .Ne SDK > 8.0.6, but my package.lock.json still shows that System.Formats.Asn1 8.0.0 is being used, is the application vulnerable?

EDIT: I realized that they use .Net when specifiying the vulnerable SDK, but use .Net Core when talking about vulnerable packages. Maybe thats where the difference lies, i. e. you are safe if you either use the .Net SDK OR If you use .Net Core and an up to date package version.

Thank you for your insights!

Improve this question

1 Answer 1

Reset to default
3

Quoting that security advisory:

If you have a runtime or SDK with a version listed, or an affected package listed in affected software or affected packages, you're exposed to the vulnerability.

In other words, any combination of packages/SDKs that includes one of the affected packages is vulnerable, even if the other SDKs/packages are updated.

Why I am trying to understand is: Which combinations of the .Net SDK and System.Formats.Asn1 are vulnerable. For example, if I follow the suggested fix and use a .Ne SDK > 8.0.6, but my package.lock.json still shows that System.Formats.Asn1 8.0.0 is being used, is the application vulnerable?

Any combination of vulnerable and non-vulnerable packages/SDKs is vulnerable. That is, even if you've installed the newer SDKs, the System.Formats.Asn1 8.0.0 package is still vulnerable. I'll note that the Visual Studio Nuget Package manager makes this especially clear: If you select the 8.0.0 package, the package manager gives a "Vulnerabilities detected" warning. This goes away if you switch to 8.0.1.

Improve this answer
2
  • This does make sense, but why then do they not state that in the How to fix section?. Also, the wording differences between ".Net" and ".Net Core" confuse me.
    – Felix
    Commented Jul 11 at 14:46
  • 1
    I'm unsure why Microsoft didn't specify that the package should be updated. Probably it's not always necessary. However, they did flag the nuget package as being vulnerable, so my recommendation is to just update it. As for the wording difference: Microsoft dropped "Core" from the framework name when they introduced .NET 5 (versions 1-3 of the Core Framework needed the word Core as a disambiguator from the previous framework). Core is still heavily used when describing projects that use these new frameworks.
    – Brian
    Commented Jul 11 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .