Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Almalinux .NET 9.0 can let attackers gain higher privileges
published 1 year ago
Summary
The Almalinux packages for .NET 9.0 – including aspnetcore-runtime, aspnetcore-runtime‑dbg, aspnetcore-targeting‑pack, dotnet, and dotnet‑apphost‑pack – contain a flaw that could let a malicious user increase their access rights on the server. This could allow the attacker to perform actions reserved for administrators. Install the updated .NET SDK 9.0.104 or .NET Runtime 9.0.3 as soon as possible to close the gap.
What to do
- Update almalinux aspnetcore-runtime-9.0 to version 9.0.3-1.el8_10.
- Update almalinux aspnetcore-runtime-dbg-9.0 to version 9.0.3-1.el8_10.
- Update almalinux aspnetcore-targeting-pack-9.0 to version 9.0.3-1.el8_10.
- Update almalinux dotnet to version 9.0.104-1.el8_10.
- Update almalinux dotnet-apphost-pack-9.0 to version 9.0.3-1.el8_10.
- Update almalinux dotnet-host to version 9.0.3-1.el8_10.
- Update almalinux dotnet-hostfxr-9.0 to version 9.0.3-1.el8_10.
- Update almalinux dotnet-runtime-9.0 to version 9.0.3-1.el8_10.
- Update almalinux dotnet-runtime-dbg-9.0 to version 9.0.3-1.el8_10.
- Update almalinux dotnet-sdk-9.0 to version 9.0.104-1.el8_10.
- Update almalinux dotnet-sdk-9.0-source-built-artifacts to version 9.0.104-1.el8_10.
- Update almalinux dotnet-sdk-aot-9.0 to version 9.0.104-1.el8_10.
- Update almalinux dotnet-sdk-dbg-9.0 to version 9.0.104-1.el8_10.
- Update almalinux dotnet-targeting-pack-9.0 to version 9.0.3-1.el8_10.
- Update almalinux dotnet-templates-9.0 to version 9.0.104-1.el8_10.
- Update almalinux netstandard-targeting-pack-2.1 to version 9.0.104-1.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | aspnetcore-runtime-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | aspnetcore-runtime-dbg-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | aspnetcore-targeting-pack-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-apphost-pack-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-host |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-hostfxr-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-runtime-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-runtime-dbg-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-sdk-9.0 |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-sdk-9.0-source-built-artifacts |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-sdk-aot-9.0 |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-sdk-dbg-9.0 |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-targeting-pack-9.0 |
< 9.0.3-1.el8_10 Fix: upgrade to 9.0.3-1.el8_10
|
| AlmaLinux:8 | almalinux | dotnet-templates-9.0 |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
| AlmaLinux:8 | almalinux | netstandard-targeting-pack-2.1 |
< 9.0.104-1.el8_10 Fix: upgrade to 9.0.104-1.el8_10
|
Original advisory text
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es):
* dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070)
Bug Fix(es) and Enhancement(s):
* dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es):
* dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070)
Bug Fix(es) and Enhancement(s):
* dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:2667 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-24070 Third Party Advisory
- https://bugzilla.redhat.com/2349733 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2025-2667.html Vendor Advisory
Timeline
Published11 Mar 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:2667 · OSV
Track software like this
Free during beta