Skip to content
Fencer Vulns
critical 9.1

CVE-2024-0057 json

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

published 2024-01-09 2 y ago modified 2026-09-10 1 mo ago also BIT-dotnet-2024-0057 , BIT-dotnet-sdk-2024-0057 , BIT-powershell-2024-0057 , EUVD-2024-0534 , GHSA-68w7-72jg-6qpp

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Patch / fix

  • nuget NuGet.CommandLine 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1
  • nuget NuGet.Packaging 5.11.6, 6.0.6, 6.3.4, 6.4.3, 6.6.2, 6.7.1, 6.8.1
  • bitnami dotnet 6.0.26, 7.0.15, 8.0.1
  • bitnami dotnet-sdk 6.0.26, 7.0.15, 8.0.1
  • bitnami powershell 7.2.18, 7.3.11, 7.4.12
  • Microsoft .NET 8.0 8.0.1
  • Microsoft .NET 7.0 7.0.15
  • Microsoft .NET 6.0 6.0.26
  • Microsoft Microsoft Visual Studio 2022 version 17.2 17.2.23
  • Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.34
  • Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.15
  • Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.11
  • Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.4
  • Microsoft NuGet 5.11.0 5.11.6.0
  • Microsoft NuGet 17.4.0 17.4.3.0
  • Microsoft NUGET 17.6.0 17.6.2.0
  • Microsoft NuGet 17.8.0 17.8.1.0
  • Microsoft PowerShell 7.2 7.2.18
  • Microsoft PowerShell 7.3 7.3.11
  • Microsoft PowerShell 7.4 7.4.2
  • Microsoft Microsoft .NET Framework 4.8 4.8.04690.02
  • Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02
  • Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.04081.03
  • Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04081.02
  • Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
  • Microsoft Microsoft .NET Framework 2.0 Service Pack 2 3.0.50727.8976
  • Microsoft Microsoft .NET Framework 3.0 Service Pack 2 3.0.50727.8976
  • dotnet6 Ubuntu 22.04 LTS 6.0.126-0ubuntu1~22.04.1
  • dotnet7 Ubuntu 22.04 LTS 7.0.115-0ubuntu1~22.04.1

ubuntu advisories UBUNTU-CVE-2024-0057

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-dotnet60-dotnet RHEL 6.0 DOTNET 6.0.126-1.el7_9
  • rh-dotnet60-dotnet-host RHEL 6.0 DOTNET 6.0.26-1.el7_9
  • rh-dotnet60-dotnet-sdk-6.0 RHEL 6.0 DOTNET 6.0.126-1.el7_9
  • rh-dotnet60-dotnet-hostfxr-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9
  • rh-dotnet60-dotnet-runtime-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9
  • rh-dotnet60-dotnet-templates-6.0 RHEL 6.0 DOTNET 6.0.126-1.el7_9
  • rh-dotnet60-aspnetcore-runtime-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9
  • rh-dotnet60-dotnet-apphost-pack-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9

red hat advisories RHSA-2024:0255RHSA-2024:0157RHSA-2024:0158RHSA-2024:0152RHSA-2024:0151RHSA-2024:0156

  • dotnet AlmaLinux 8 8.0.101-1.el8_9
  • dotnet-host AlmaLinux 8 8.0.1-1.el8_9
  • dotnet-sdk-8.0 AlmaLinux 8 8.0.101-1.el8_9
  • dotnet-hostfxr-8.0 AlmaLinux 8 8.0.1-1.el8_9
  • dotnet-runtime-8.0 AlmaLinux 8 8.0.1-1.el8_9
  • dotnet-templates-8.0 AlmaLinux 8 8.0.101-1.el8_9
  • aspnetcore-runtime-8.0 AlmaLinux 8 8.0.1-1.el8_9
  • dotnet-apphost-pack-8.0 AlmaLinux 8 8.0.1-1.el8_9

almalinux advisories ALSA-2024:0150ALSA-2024:0151ALSA-2024:0152ALSA-2024:0156ALSA-2024:0157ALSA-2024:0158

  • dotnet8.0 Rocky Linux 8 8.0.101-1.el8_9
  • dotnet7.0 Rocky Linux 8 7.0.115-1.el8_9
  • dotnet6.0 Rocky Linux 8 6.0.126-1.el8_9

rocky linux advisories RLSA-2024:0150RLSA-2024:0157RLSA-2024:0158

  • dotnet6-build Alpine 3.20, Alpine 3.19 6.0.126-r0
  • dotnet7-build Alpine 3.19 7.0.115-r0
  • dotnet6-runtime Alpine 3.20, Alpine 3.19 6.0.26-r0
  • dotnet7-runtime Alpine 3.19 7.0.15-r0

alpine advisories ALPINE-CVE-2024-0057

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-0057 updated cvss 9.8

dotnet: X509 Certificates - Validation Bypass across Azure

  • Red Hat .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet60-dotnet 6.0.126-1.el7_9, rh-dotnet60-dotnet-host 6.0.26-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.126-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.126-1.el7_9, +6 more Red Hat .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet60-dotnet 6.0.126-1.el7_9, rh-dotnet60-dotnet-host 6.0.26-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.126-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.126-1.el7_9, +6 more Red Hat .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet60-dotnet 6.0.126-1.el7_9, rh-dotnet60-dotnet-host 6.0.26-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.126-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.126-1.el7_9, +6 more
    fixed: vendor fix RHSA-2024:0255
  • Red Hat CodeReady Linux Builder (v. 8) dotnet 8.0.101-1.el8_9, dotnet-host 8.0.1-1.el8_9, dotnet6.0 6.0.126-1.el8_9, dotnet7.0 7.0.115-1.el8_9, dotnet8.0 8.0.101-1.el8_9, dotnet-sdk-6.0 6.0.126-1.el8_9, +27 more
    fixed: vendor fix RHSA-2024:0158
  • Red Hat CodeReady Linux Builder (v. 9) dotnet-host 8.0.1-1.el9_3, dotnet6.0 6.0.126-1.el9_3, dotnet7.0 7.0.115-1.el9_3, dotnet8.0 8.0.101-1.el9_3, dotnet-sdk-6.0 6.0.126-1.el9_3, dotnet-sdk-7.0 7.0.115-1.el9_3, +26 more
    fixed: vendor fix RHSA-2024:0156
  • Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.101-1.el8_9, dotnet-host 8.0.1-1.el8_9, dotnet6.0 6.0.126-1.el8_9, dotnet7.0 7.0.115-1.el8_9, dotnet8.0 8.0.101-1.el8_9, dotnet-sdk-6.0 6.0.126-1.el8_9, +27 more
    fixed: vendor fix RHSA-2024:0158
  • Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.1-1.el9_3, dotnet6.0 6.0.126-1.el9_3, dotnet7.0 7.0.115-1.el9_3, dotnet8.0 8.0.101-1.el9_3, dotnet-sdk-6.0 6.0.126-1.el9_3, dotnet-sdk-7.0 7.0.115-1.el9_3, +26 more
    fixed: vendor fix RHSA-2024:0156

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

2.78% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
nuget NuGet.CommandLine
>=4.6.0, <5.11.6
>=6.0.0, <6.0.6
>=6.3.0, <6.3.4
>=6.4.0, <6.4.3
>=6.6.0, <6.6.2
>=6.7.0, <6.7.1
>=6.8.0, <6.8.1
5.11.6
6.0.6
6.3.4
6.4.3
6.6.2
6.7.1
6.8.1
nuget NuGet.Packaging
>=4.6.0, <5.11.6
>=6.0.0, <6.0.6
>=6.3.0, <6.3.4
>=6.4.0, <6.4.3
>=6.6.0, <6.6.2
>=6.7.0, <6.7.1
>=6.8.0, <6.8.1
5.11.6
6.0.6
6.3.4
6.4.3
6.6.2
6.7.1
6.8.1
bitnami dotnet
>=6.0.0, <6.0.26
>=7.0.0, <7.0.15
>=8.0.0, <8.0.1
6.0.26
7.0.15
8.0.1
bitnami dotnet-sdk
>=6.0.0, <6.0.26
>=7.0.0, <7.0.15
>=8.0.0, <8.0.1
6.0.26
7.0.15
8.0.1
bitnami powershell
>=7.2.0, <7.2.18
>=7.3.0, <7.3.11
>=7.4.0, <7.4.12
7.2.18
7.3.11
7.4.12

Affected products

  • Microsoft .NET 8.0
  • Microsoft .NET 7.0
  • Microsoft .NET 6.0
  • Microsoft Microsoft Visual Studio 2022 version 17.2
  • Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Microsoft Visual Studio 2022 version 17.4
  • Microsoft Microsoft Visual Studio 2022 version 17.6
  • Microsoft Microsoft Visual Studio 2022 version 17.8
  • Microsoft NuGet 5.11.0
  • Microsoft NuGet 17.4.0
  • Microsoft NUGET 17.6.0
  • Microsoft NuGet 17.8.0
  • Microsoft PowerShell 7.2
  • Microsoft PowerShell 7.3
  • Microsoft PowerShell 7.4
  • Microsoft Microsoft .NET Framework 4.8
  • Microsoft Microsoft .NET Framework 3.5 AND 4.8
  • Microsoft Microsoft .NET Framework 3.5 AND 4.7.2
  • Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
  • Microsoft Microsoft .NET Framework 3.5 AND 4.8.1
  • Microsoft Microsoft .NET Framework 2.0 Service Pack 2
  • Microsoft Microsoft .NET Framework 3.0 Service Pack 2

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.