NuGet Client Elevation of Privilege Vulnerability
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| .net | Microsoft | 6.0.0 (including) | 6.0.0 (including) |
| .net_core | Microsoft | 3.1 (including) | 3.1 (including) |
| Visual_studio_2019 | Microsoft | 16.0.0 (including) | 16.9.26 (excluding) |
| Visual_studio_2019 | Microsoft | 16.10.0 (including) | 16.11.20 (excluding) |
| Visual_studio_2022 | Microsoft | 17.0 (including) | 17.0.15 (excluding) |
| Visual_studio_2022 | Microsoft | 17.2.0 (including) | 17.2.9 (excluding) |
| Visual_studio_2022 | Microsoft | 17.3 (including) | 17.3.6 (excluding) |
| Visual_studio_2022 | Microsoft | 17.3 (including) | 17.3.7 (excluding) |
| .NET Core on Red Hat Enterprise Linux | RedHat | rh-dotnet31-dotnet-0:3.1.424-1.el7_9 | * |
| .NET Core on Red Hat Enterprise Linux | RedHat | rh-dotnet60-dotnet-0:6.0.110-1.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet6.0-0:6.0.110-1.el8_6 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet3.1-0:3.1.424-1.el8_6 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet7.0-0:7.0.100-0.4.rc2.el8_7 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet6.0-0:6.0.110-1.el9_0 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet7.0-0:7.0.100-0.5.rc2.el9_1 | * |
| Dotnet6 | Ubuntu | devel | * |
| Dotnet6 | Ubuntu | jammy | * |
| Dotnet6 | Ubuntu | kinetic | * |
| Dotnet6 | Ubuntu | upstream | * |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41032
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7BMHO5ITRBZREVTEKHQRGSFRPDMALV3/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41032