Red Hat Bug Fix Advisory: .NET 6.0 bug fix and enhancement update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products66

• Red Hat CodeReady Linux Builder (v. 9)
• Red Hat Enterprise Linux AppStream (v. 9)
• aspnetcore-runtime-6.0-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• aspnetcore-runtime-6.0-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• aspnetcore-runtime-6.0-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• aspnetcore-targeting-pack-6.0-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• aspnetcore-targeting-pack-6.0-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• aspnetcore-targeting-pack-6.0-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-apphost-pack-6.0-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-apphost-pack-6.0-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-apphost-pack-6.0-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-apphost-pack-6.0-debuginfo-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
• dotnet-apphost-pack-6.0-debuginfo-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-apphost-pack-6.0-debuginfo-0:6.0.35-2.el9_5.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
• dotnet-apphost-pack-6.0-debuginfo-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-apphost-pack-6.0-debuginfo-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
• dotnet-apphost-pack-6.0-debuginfo-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-hostfxr-6.0-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-hostfxr-6.0-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-hostfxr-6.0-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-hostfxr-6.0-debuginfo-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
• dotnet-hostfxr-6.0-debuginfo-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-hostfxr-6.0-debuginfo-0:6.0.35-2.el9_5.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
• dotnet-hostfxr-6.0-debuginfo-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-hostfxr-6.0-debuginfo-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
• dotnet-hostfxr-6.0-debuginfo-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-runtime-6.0-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-runtime-6.0-0:6.0.35-2.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-runtime-6.0-0:6.0.35-2.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• dotnet-runtime-6.0-debuginfo-0:6.0.35-2.el9_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
• +36 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0.

🔗 References (2)

• selfhttps://access.redhat.com/errata/RHBA-2024:9550
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_9550.json