-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Releases.json for .NET 8.0 Missing Required Package Versions #9705
Comments
@rbhanda can you check this? |
Hello, |
I am using .NET 8.0 for my Ubuntu 24 VM, and I’ve been referencing the release-metadata for version updates. I am attempting to fix some vulnerabilities, and the report suggests upgrading the following packages from version 8.0.12-0ubuntu124.04.1 to 8.0.108-8.0.8-0ubuntu124.04.1: dotnet-host-8.0 I would appreciate any guidance or updated download links for these packages so I can proceed with addressing the vulnerabilities. Note:- Vulnerability report suggesting (Refer to Ubuntu security advisory USN-6959-1 (https://ubuntu.com/security/notices/USN-6959-1) for updates and patch information. |
I am using .NET 8.0 for my Ubuntu 24 VM, and I’ve been referencing the release-metadata for version updates. I am attempting to fix some vulnerabilities, and the report suggests upgrading the following packages from version 8.0.12-0ubuntu124.04.1 to 8.0.108-8.0.8-0ubuntu124.04.1: dotnet-host-8.0 I would appreciate any guidance or updated download links for these packages so I can proceed with addressing the vulnerabilities. Note:- Vulnerability report suggesting (Refer to Ubuntu security advisory USN-6959-1 (https://ubuntu.com/security/notices/USN-6959-1) for updates and patch information. |
@leecow do you know about these files `I am attempting to fix some vulnerabilities, and the report suggests upgrading the following packages from version 8.0.12-0ubuntu124.04.1 to 8.0.108-8.0.8-0ubuntu124.04.1: dotnet-host-8.0 |
@ushak8089 - for 24.04, it's recommended to use the .NET packages provided by Canonical, rather than the Microsoft provided packages (details here). An easy way to confirm you are using the Canonical packages is to run
.NET 8.0.12 is available now from Canonical so simply running |
@leecow Than you for quick response! However, this approach raises potential security vulnerabilities for ubuntu 24.04 as we are directly fetching packages from Microsoft’s blob storage. Could you provide a direct, secure link to Canonical-provided .NET packages that we can use instead, ensuring compliance with Ubuntu's repositories? This will help us align with Canonical's package management and address any vulnerability concerns in our automated workflows. Thank you for your assistance! |
.NET 8 updates for Noble are available on Canonical's "noble-updates" feed under devel. See the following: |
Thank you for sharing the links to Canonical's "noble-updates" feed and Launchpad for .NET 8 packages. However, I noticed that the required 8.0.108 version is not available in the repository. This version is crucial for resolving the reported vulnerabilities in our environment. Your assistance in resolving this issue would be greatly appreciated. |
Based on my check before my first reply this evening, the repo has 8.0.112 available. This is supported by the information availble at https://launchpad.net/ubuntu/noble/+package/dotnet8. |
I just noticed you also mention 22.04. Confirmed that 8.0.12 is also available in the Jammy update feed.
|
We’re encountering an issue with .NET packages on Ubuntu 24. While the correct versions version here: azure-arm.build_vhd: Get:2 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-host-8.0 amd64 8.0.12-0ubuntu1 It is looking for downgrade it seems (Refer to Ubuntu security advisory USN-6959-1 (https://ubuntu.com/security/notices/USN-6959-1) for updates and patch information. Package Installed Version Required Version Note:- this issue is not present on Ubuntu 22, where the installation works without triggering vulnerabilities. Could you help us understand: Why the advisory suggests downgrading to older versions, even though newer versions are installed? |
@dviererbe - could you have a look at the questions above? ^^^ |
If you're encountering an issue, it's with the Canonical feed, and not something we can resolve. I'm chatting with Canonical today and will ask for them to follow up with this issue. |
Thank you very much @leecow |
Thanks Lee for tagging me :) @ushak8089 Hello, the advisory USN-6959-1 you are referring to is from 13 August 2024. There are newer advisories – the latest advisory for .NET 8 is USN-7210-1, which recommends upgrading to the versions you have already installed.
question: Which tool are you using, that recommends you to downgrade? If this is a Canonical provided tool I would like to investigate what went wrong. note: I also see that your tool displays the source package version as "Required Version", but displays the binary package version as "Installed Version":
It could also be possible that your tool assumes that the version identifiers for binary and source packages are the same, which is not the case for Ubuntu .NET packages. Background: Therefore it could be that your tool thinks that version Let me know if this was helpful :) |
Thank you very much for your response @dviererbe @leecow Also, I am reviewing the .NET 8.0.12 release notes here, and it looks like 8.0.12 was released on January 14th. I don’t see the vulnerability mentioned in USN-6959-1 CVE-2024-38167 being patched in this release. Could this be the reason the vulnerability is still detected on Ubuntu 24.04 and why a downgrade is recommended? |
Because this scanner looks to be proprietary I can only guess. I suspect a combination of the two outlined issues above:
todo: This behavior should be reported to Qualy, because only they can fix it. If you want, I can contact them. If you want to contact them, please keep me in the loop as I want to prevent this from happening to other Ubuntu users. |
Yes please @dviererbe please contact them . I really appreciate. Thank you! |
|
@dviererbe Thank you for confirming! |
@dviere could you please keep me posted about the Qualy team updates. |
@ushak8089 FYI: I have opened a support case with Qualy. I will comment here when I get any updates. |
@dviererbe sounds good! Thank you very much. |
@ushak8089 the Qualys support asked me share further information with them:
question: Can you write me a response to the above noted inquiries by the Qualys Support at [email protected]? suggestion: If you want, I can put you in CC of the Qualys support emails, so you are in the loop :) |
Thank you for the response @dvierebe As requested, please find the details of the Qualys report for CVE-2024-38167: Vulnerability Details Impact: Detected Results: Package Installed Version Required Version Additional Details |
@dviererbe please let me know if you need any additional information. And also please cc me as well. Thank you! |
@ushak8089 Sorry, I do not know your E-Mail address. Could you give me an E-Mail address I can share with Qualys support and use to CC you? |
@dviererbe Sorry i forgot to mention, My email ID is [email protected] |
URL(s)
Hello,
I noticed that the releases.json file for .NET 8.0 hosted at https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json does not include the required package versions (8.0.108-8.0.8-0ubuntu1~24.04.1) for the following packages:
dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0
Description
Hello,
I noticed that the releases.json file for .NET 8.0 hosted at https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json does not include the required package versions (8.0.108-8.0.8-0ubuntu1~24.04.1) for the following packages:
dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0
This discrepancy is causing issues with automated workflows and dependency checks that rely on this file for versioning information.
Could you please confirm if there’s an issue with the metadata update process or provide clarification on why the required versions are missing?
The text was updated successfully, but these errors were encountered: