Red Hat Security AdvisoryRHSA-2025:18149
.NET 8.0 security update
Released 2025-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.21-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.21-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.21-1.el9_6 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_6
Fixes 3 records
Priority HIGH 79
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.67162 · Published 2025-10-14 · Partial fix · 2.3.6, 8.0.21 +5 CWE-444
Priority LOW 35
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00622 · Published 2025-10-14 · Partial fix · 8.0.21, 9.0.10 +6 CWE-59
Priority LOW 27
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00736 · Published 2025-10-14 · Partial fix · 8.0.21, 9.0.10 +7 CWE-326
