CVE-2022-29117

high

Published 2022-05-10 · Modified 2022-05-11

CVSS v3

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2

5.0

VIR risk

7.5

Description

Important: .NET Core 3.1 security, bug fix, and enhancement update

Predictions

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2022-2202.html

vendor Authored 2026-05-27

Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2022-2200.html

vendor Authored 2026-05-27

Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2022-2199.html

vendor Authored 2026-05-27

Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2022:2199

vendor Authored 2026-05-27

Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2022:2200

vendor Authored 2026-05-27

Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2022:2202

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2022-29117.html

vendor Authored 2026-05-27

Vendor advisory: af854a3a-2127-422b-91ae-364da2661108 — https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29117

vendor Authored 2026-05-27

Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2022:4588

OS impact

OS	Version	Status
rhel	9	fixed
sles		affected
rocky	8	fixed
fedora	34	affected
fedora	35	affected
fedora	36	affected

Package impact

Ecosystem	Package	Vulnerable	Fixed
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.Owin.Security.Cookies	`<4.2.2`	`4.2.2`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.Owin	`<4.2.2`	`4.2.2`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>=3.0.0,<3.1.25`	`3.1.25`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>=5.0.0,<5.0.17`	`5.0.17`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>=6.0.0,<6.0.5`	`6.0.5`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>=6.0.0,<6.0.5`	`6.0.5`

Application impact

Vendor	Product	Versions
microsoft	.net	`5.0`
microsoft	.net	`6.0.0`
microsoft	.net_core	`3.1`
microsoft	visual_studio_2019	`{"startIncluding":"16.0","endIncluding":"16.0.11"}`
microsoft	visual_studio_2022	`17.0`
microsoft	visual_studio_2022	`17.1`

References

CWEs

CWE-400

Verify integrity in audit chain (admin only). AS-IS.