USN-6438-2
.Net regressions
USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix for CVE-2023-36799 was incomplete. This update fixes the problem.
Original advisory details:
Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-36799)
It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-44487)
What each source reports
OSV No score
.Net regressions
USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix for CVE-2023-36799 was incomplete. This update fixes the problem.
Original advisory details:
Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-36799)
It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-44487)
- Record
USN-6438-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dotnet6Ubuntu:23.10 |
before 6.0.124-0ubuntu1~23.10.1, plus listed versions 6.0.116-0ubuntu26.0.116-0ubuntu36.0.118-0ubuntu16.0.119-0ubuntu16.0.120-0ubuntu16.0.120-0ubuntu26.0.121-0ubuntu16.0.123-0ubuntu1 |
6.0.124-0ubuntu1~23.10.1 |
dotnet7Ubuntu:23.10 |
before 7.0.113-0ubuntu1~23.10.1, plus listed versions 7.0.105-0ubuntu27.0.105-0ubuntu37.0.107-0ubuntu17.0.108-0ubuntu27.0.109-0ubuntu17.0.109-0ubuntu27.0.110-0ubuntu17.0.112-0ubuntu1 |
7.0.113-0ubuntu1~23.10.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6438-2 is a vulnerability with no CVSS score yet in dotnet6, published October 25, 2023. No source lists public exploit code. Fixed in dotnet6 6.0.124-0ubuntu1~23.10.1.