Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux .NET 8.0 enables remote code execution
published 1 year ago
Summary
The AlmaLinux packages for .NET 8.0 (runtime, debugging, targeting and host components) can be tricked into running malicious code from an attacker. Updating to .NET SDK 8.0.117 or Runtime 8.0.17 removes the risk. Apply the latest AlmaLinux .NET 8.0 updates as soon as possible.
What to do
- Update almalinux aspnetcore-runtime-8.0 to version 8.0.17-1.el10_0.
- Update almalinux aspnetcore-runtime-dbg-8.0 to version 8.0.17-1.el10_0.
- Update almalinux aspnetcore-targeting-pack-8.0 to version 8.0.17-1.el10_0.
- Update almalinux dotnet-apphost-pack-8.0 to version 8.0.17-1.el10_0.
- Update almalinux dotnet-hostfxr-8.0 to version 8.0.17-1.el10_0.
- Update almalinux dotnet-runtime-8.0 to version 8.0.17-1.el10_0.
- Update almalinux dotnet-runtime-dbg-8.0 to version 8.0.17-1.el10_0.
- Update almalinux dotnet-sdk-8.0 to version 8.0.117-1.el10_0.
- Update almalinux dotnet-sdk-8.0-source-built-artifacts to version 8.0.117-1.el10_0.
- Update almalinux dotnet-sdk-dbg-8.0 to version 8.0.117-1.el10_0.
- Update almalinux dotnet-targeting-pack-8.0 to version 8.0.17-1.el10_0.
- Update almalinux dotnet-templates-8.0 to version 8.0.117-1.el10_0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | aspnetcore-runtime-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | aspnetcore-runtime-dbg-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | aspnetcore-targeting-pack-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-apphost-pack-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-hostfxr-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-runtime-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-runtime-dbg-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-sdk-8.0 |
< 8.0.117-1.el10_0 Fix: upgrade to 8.0.117-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-sdk-8.0-source-built-artifacts |
< 8.0.117-1.el10_0 Fix: upgrade to 8.0.117-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-sdk-dbg-8.0 |
< 8.0.117-1.el10_0 Fix: upgrade to 8.0.117-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-targeting-pack-8.0 |
< 8.0.17-1.el10_0 Fix: upgrade to 8.0.17-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-templates-8.0 |
< 8.0.117-1.el10_0 Fix: upgrade to 8.0.117-1.el10_0
|
Original advisory text
Important: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es):
* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es):
* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:8814 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-30399 Third Party Advisory
- https://bugzilla.redhat.com/2369701 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2025-8814.html Vendor Advisory
Timeline
Published11 Jun 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:8814 · OSV
Track software like this
Free during beta