21–30 of 57 posts
Interesting that they put it as 'Less likely to be exploited' but at the same time give it a 9.9 riskiness. It sort of implies it will be quikcly under active investigation by hostile actors, and then get's raised to an urgent threat?
Earlier quoted context omitted.
This is a dumb way of scoring the bug. The bug itself doesn't enable any of those. An app using the library might have that vuln.
Score which is based how someone could theoretically use the tool. It might be right, but it also feels so wrong. I would in reality probably rank this issue lower. And in some more properly engineered systems it would have lot less criticality.
> someone could theoretically use the tool
makes every single logic error a 9.9
Earlier quoted context omitted.
The last sentence is not correct. ASP.NET is part of .NET Framework which is still supported by nature of being included with Windows, and follows its support lifecycle. https://dotnet.microsoft.com/en-us/platform/support/policy/a... This is, IMO, a bad thing, and Microsoft needs to break this chain at some point, at least for ASP.NET. But, it is still technically supported.
Yes, you are right, if you are on 5.0+, however the 4.x stuff is definitely out of support. Sorry, I did not know they had actually brought non-Core ASP.NET forward into 5.0+, but it makes sense given how much of .NET Framework they continued support for and how much ASP.NET and Forms stuff is still around in enterprise with no budget for bringing it forward. Totally agree with breaking the chain though, we moved to…
None of this is true, you've gotten yourself very confused. The only real change with .NET 5 was the "Core" name being dropped and the Mono runtime being merged in. .NET Framework 4.x is still around and is still fully supported for legacy applications.
Earlier quoted context omitted.
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
The last sentence is not correct. ASP.NET is part of .NET Framework which is still supported by nature of being included with Windows, and follows its support lifecycle. https://dotnet.microsoft.com/en-us/platform/support/policy/a... This is, IMO, a bad thing, and Microsoft needs to break this chain at some point, at least for ASP.NET. But, it is still technically supported.
And there is currently no official other supported version supported like .NET Framework 4.8 or simply .NET
> If you are running .NET 8 or later install the .NET update from Microsoft Update, then restart your application or reboot the machine. This is why I advocate for .NET in serious business contexts. You often don't have to rebuild or redeploy your software if you are using the included batteries as intended. A devops intern could handle this fix. Contrast with virtually any other ecosystem.
9.9 feels like the teacher who never gives out 10/10 or A
For context around the score https://github.com/dotnet/aspnetcore/issues/64033#issuecomme...
This is a dumb way of scoring the bug. The bug itself doesn't enable any of those. An app using the library might have that vuln.
I see a lot of critical (9+) supposed JavaScript "remote code execution with no authentication" CVEs being posted...
Right, if you are running it in an NPM server exposed to malicious user input with no authentication. Actually it runs client side in the browser and at best it's a prototype pollution vuln with a much lower score.
Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
https://learn.microsoft.com/en-us/dotnet/fundamentals/implem...
Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
There is both a .Net and a .Net Framework, with the latest .net framework update being about ~3 years old, years after .net 5 was released.
I'm finally working on migrating (migrate, not upgrade) from .Net framework 4.7.2 to .Net 9
It was a previously impossible / very difficult due to strong dependencies on functionality which only existed in .Net Framework.
With the continued development of Winforms on .Net 9+, it finally made sense to start migrating over.