{"id":"CVE-2023-29331","published":"2023-06-14T14:52:19Z","modified":"2025-02-28T21:09:08Z","title":".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability","vendor":"Microsoft","product":".NET 6.0","tier":"tail","description":{"text":".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02627,"percentile":0.85443,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331","tags":["vendor-advisory"]}],"priority":{"score":22.3,"factors":[{"name":"EPSS percentile","points":17.09},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"microsoft","affectedVersions":[{"vendor":"Microsoft","product":".NET 6.0","versions":[">= 6.0.0, < 6.0.18"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[">= 7.0.0, < 7.0.7"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.0","versions":[">= 17.0.0, < 17.0.22"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[">= 17.2.0, < 17.2.16"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[">= 17.4.0, < 17.4.8"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[">= 17.6.0, < 17.6.3"]},{"vendor":"Microsoft","product":"PowerShell 7.2","versions":[">= 7.2.0, < 7.2.12"]},{"vendor":"Microsoft","product":"PowerShell 7.3","versions":[">= 7.3.0, < 7.3.5"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 4.8","versions":[">= 4.8.0, < 4.8.4644.0"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.8","versions":[">= 4.8.0, < 4.8.4644.0"]}],"affected":[{"ecosystem":"NuGet","package":"Microsoft.Windows.Compatibility","vulnerableRanges":[">=7.0.0, <7.0.3",">=6.0.0, <6.0.6"],"patched":["7.0.3","6.0.6"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"System.Security.Cryptography.Pkcs","vulnerableRanges":[">=7.0.0, <7.0.2",">=6.0.0, <6.0.3"],"patched":["7.0.2","6.0.3"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm","vulnerableRanges":[">=7.0.0, <7.0.7",">=6.0.0, <6.0.18"],"patched":["7.0.7","6.0.18"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-arm64","vulnerableRanges":[">=6.0.0, <6.0.18",">=7.0.0, <7.0.7"],"patched":["6.0.18","7.0.7"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm","vulnerableRanges":[">=7.0.0, <7.0.7",">=6.0.0, <6.0.18"],"patched":["7.0.7","6.0.18"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=7.0.0, <7.0.7",">=6.0.0, <6.0.18"],"patched":["7.0.7","6.0.18"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=6.0.0, <6.0.18",">=7.0.0, <7.0.7"],"patched":["6.0.18","7.0.7"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.linux-x64","vulnerableRanges":[">=6.0.0, <6.0.18",">=7.0.0, <7.0.7"],"patched":["6.0.18","7.0.7"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.osx-arm64","vulnerableRanges":[">=6.0.0, <6.0.18",">=7.0.0, <7.0.7"],"patched":["6.0.18","7.0.7"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.NETCore.App.Runtime.osx-x64","vulnerableRanges":[">=6.0.0, <6.0.18",">=7.0.0, <7.0.7"],"patched":["6.0.18","7.0.7"],"from":["GHSA-555c-2p6r-68mm"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1694","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-microsoft-net-cwe-400","packageHistory":[{"cve":"CVE-2022-24512","published":"2022-03-09","fixed":"6.0.3","kev":false},{"cve":"CVE-2023-21538","published":"2023-01-10","fixed":"6.0.13","kev":false,"link":{"from":"CVE-2023-21538","to":"CVE-2023-29331","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm","fromFixed":"6.0.13","toFixed":"6.0.18","daysApart":155},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm64","fromFixed":"6.0.13","toFixed":"6.0.18","daysApart":155}]}},{"cve":"CVE-2023-24936","published":"2023-06-14","fixed":"7.0.7","kev":false},{"cve":"CVE-2023-29331","published":"2023-06-14","fixed":"7.0.7","kev":false},{"cve":"CVE-2023-33128","published":"2023-06-13","fixed":"7.0.7","kev":false},{"cve":"CVE-2023-36799","published":"2023-09-12","fixed":"7.0.11","kev":false},{"cve":"CVE-2024-21392","published":"2024-03-12","fixed":"8.0.3","kev":false}],"package":"NuGet:Microsoft.NETCore.App.Runtime.linux-arm"}}