Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdoaHAtOTk3dy1xcjI4

.NET Core Remote Code Execution Vulnerability

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Discussion

Discussion for this issue can be found at dotnet/runtime#49377

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name Vulnerable Versions Secure Versions
System.Text.Encodings.Web 4.0.0 - 4.5.0 4.5.1
System.Text.Encodings.Web 4.6.0-4.7.1 4.7.2
System.Text.Encodings.Web 5.0.0 5.0.1

Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

Permalink: https://github.com/advisories/GHSA-ghhp-997w-qr28
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdoaHAtOTk3dy1xcjI4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 3 years ago
Updated: 4 months ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-ghhp-997w-qr28, CVE-2021-26701
References: Blast Radius: 1.0

Affected Packages

nuget:System.Text.Encodings.Web
Dependent packages: 0
Dependent repositories: 0
Downloads: 2,524,815,948 total
Affected Version Ranges: = 5.0.0, >= 4.6.0, < 4.7.2, >= 4.0.0, < 4.5.1
Fixed in: 5.0.1, 4.7.2, 4.5.1
All affected versions: 4.0.0, 4.0.1, 4.3.0, 4.3.1, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.7.1, 5.0.0
All unaffected versions: 4.5.1, 4.7.2, 5.0.1, 6.0.0, 7.0.0, 8.0.0