An update of the dotnet package has been released.

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0321 advisory.

    This advisory aggregates security fixes for the dotnet6.0 SRPM in CIQ LTS 8.8. It addresses 6 CVEs:
    CVE-2024-43485, CVE-2024-43484, CVE-2024-43483, CVE-2024-0057, CVE-2024-0056, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7851 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.135 and .NET Runtime 6.0.35.

    Security Fix(es):

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)
    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)
    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)

    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.35 or 8.x prior to 8.0.10. It is, therefore, affected by denial of service vulnerability as referenced in the October 2024 advisory:

  - .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (CVE-2024-43483, CVE-2024-43484)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-43485)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8036 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.135 and .NET Runtime 6.0.1.35.

    Security Fix(es):

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)
    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)
    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)

    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8047 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.135 and .NET Runtime 6.0.1.35.

    Security Fix(es):

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)
    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)
    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)

    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:7851 advisory.

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)
    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)
    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)

    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (CVE-2024-43483)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0727 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-38229:
    A flaw was found in dotnet. When closing an HTTP/3 stream while application code is writing to the     response body, a race condition can cause a use-after-free.

    CVE-2024-43483:
    A flaw was found in dotnet. The System.Security.Cryptography.Cose, System.IO.Packaging and     System.Runtime.Caching components may be exposed to hostile input, making them susceptible to hash     flooding attacks, resulting in denial of service.

    CVE-2024-43484:
    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    CVE-2024-43485:
    .NET and Visual Studio Denial of Service Vulnerability

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0726 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-43483:
    A flaw was found in dotnet. The System.Security.Cryptography.Cose, System.IO.Packaging and     System.Runtime.Caching components may be exposed to hostile input, making them susceptible to hash     flooding attacks, resulting in denial of service.

    CVE-2024-43484:
    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    CVE-2024-43485:
    .NET and Visual Studio Denial of Service Vulnerability

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0675 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-43485:
    .NET and Visual Studio Denial of Service Vulnerability

    CVE-2024-43483:
    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    CVE-2024-43484:
    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2024_7867 advisory.

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)
    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)
    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484)

    * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483)

    * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	2025/5/22	2025/6/13	high
333884	Photon OS 5.0: Dotnet PHSA-2025-5.0-91-0499	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/12	high
234310	Photon OS 5.0: Dotnet PHSA-2025-5.0-0499	Nessus	PhotonOS Local Security Checks	2025/4/13	2025/4/14	critical
354060	Rocky Linux 8.8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc Multiple Vulnerabilities (ciqsa-2026_0321)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
208439	RHEL 8 : .NET 6.0 (RHSA-2024:7851)	Nessus	Red Hat Local Security Checks	2024/10/9	2024/11/8	high
208754	Security Update for Microsoft .NET Core SDK (October 2024)	Nessus	Windows	2024/10/11	2026/5/19	high
208991	RHEL 8 : .NET 6.0 (RHSA-2024:8036)	Nessus	Red Hat Local Security Checks	2024/10/14	2024/10/14	high
208999	RHEL 9 : .NET 6.0 (RHSA-2024:8047)	Nessus	Red Hat Local Security Checks	2024/10/14	2024/10/14	high
209696	RockyLinux 8 : .NET 6.0 (RLSA-2024:7851)	Nessus	Rocky Linux Local Security Checks	2024/10/25	2024/11/15	high
260560	Linux Distros Unpatched Vulnerability : CVE-2024-43483	Nessus	Misc.	2025/9/2	2025/12/1	high
238536	TencentOS Server 3: .NET 8.0 (TSSA-2024:0727)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
239349	TencentOS Server 3: .NET 6.0 (TSSA-2024:0726)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
239611	TencentOS Server 4: dotnet6.0 (TSSA-2024:0675)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high
357420	Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc Multiple Vulnerabilities (crlsa-2024_7867)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

critical

high

high

high

high

high

high

high

critical

high

high

high