CVE-Katalog

CVE-2023-38180

UBUNTU-

[CVE-Katalog]

USN-6278-1 fixed several vulnerabilities in .NET. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that .NET did properly handle the execution of certain commands. An attacker could possibly use this issue to achieve remote code execution. (CVE-2023-35390) Benoit Foucher discovered that .NET did not properly implement the QUIC stream limit in HTTP/3. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-38178) It was discovered that .NET did not properly handle the disconnection of potentially malicious clients interfacing with a Kestrel server. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-38180)

Schweregrad
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
14.13% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntu22.04dotnet66.0.108-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.109-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.110-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.111-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.113-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.116-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.118-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.119-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.120-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.121-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.105-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.107-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]

Showing 12 observations. All 15 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Ubuntu22.04dotnet66.0.108-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.109-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.110-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.111-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.113-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.116-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.118-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.119-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.120-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet66.0.121-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.105-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.107-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.108-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.109-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Ubuntu22.04dotnet77.0.110-0ubuntu1~22.04.1UnknownSource applicability is not established[USN-6278-2][UBUNTU-CVE-2023-38180]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "dotnet6",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.121-0ubuntu1~22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "6.0.108-0ubuntu1~22.04.1",
        "6.0.109-0ubuntu1~22.04.1",
        "6.0.110-0ubuntu1~22.04.1",
        "6.0.111-0ubuntu1~22.04.1",
        "6.0.113-0ubuntu1~22.04.1",
        "6.0.116-0ubuntu1~22.04.1",
        "6.0.118-0ubuntu1~22.04.1",
        "6.0.119-0ubuntu1~22.04.1",
        "6.0.120-0ubuntu1~22.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6278-2",
      "fixed_version": "6.0.121-0ubuntu1~22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6278-2",
      "provider_updated_at": "2026-02-10T04:43:14Z",
      "applicability_unknown": true
    },
    {
      "name": "dotnet7",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.110-0ubuntu1~22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "7.0.105-0ubuntu1~22.04.1",
        "7.0.107-0ubuntu1~22.04.1",
        "7.0.108-0ubuntu1~22.04.1",
        "7.0.109-0ubuntu1~22.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6278-2",
      "fixed_version": "7.0.110-0ubuntu1~22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6278-2",
      "provider_updated_at": "2026-02-10T04:43:14Z",
      "applicability_unknown": true
    },
    {
      "name": "dotnet6",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.121-0ubuntu1~22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "6.0.108-0ubuntu1~22.04.1",
        "6.0.109-0ubuntu1~22.04.1",
        "6.0.110-0ubuntu1~22.04.1",
        "6.0.111-0ubuntu1~22.04.1",
        "6.0.113-0ubuntu1~22.04.1",
        "6.0.116-0ubuntu1~22.04.1",
        "6.0.118-0ubuntu1~22.04.1",
        "6.0.119-0ubuntu1~22.04.1",
        "6.0.120-0ubuntu1~22.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-38180",
      "fixed_version": "6.0.121-0ubuntu1~22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-38180",
      "provider_updated_at": "2026-02-04T03:35:26.069841Z",
      "applicability_unknown": true
    },
    {
      "name": "dotnet7",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.110-0ubuntu1~22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "7.0.105-0ubuntu1~22.04.1",
        "7.0.107-0ubuntu1~22.04.1",
        "7.0.108-0ubuntu1~22.04.1",
        "7.0.109-0ubuntu1~22.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-38180",
      "fixed_version": "7.0.110-0ubuntu1~22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-38180",
      "provider_updated_at": "2026-02-04T03:35:26.069841Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Die Paketzuordnung läuft.

Beobachtet:

Referenzen

[CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]