.NET Core and Visual Studio Denial of Service Vulnerability

An update of the dotnet package has been released.

The Microsoft .NET Core installation on the remote host is version 3.1.x prior to 3.1.16, 5.x prior to 5.0.7. It is, therefore, affected by a denial of service vulnerability. An unauthenticated, remote attacker can exploit this to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48ca39b6ad advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-c3d7fc8949 advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-56e894d5ca advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-b881ee9839 advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0474 advisory.

    [2.1.521-1]
    - Update to .NET Core SDK 2.1.521 and Runtime 2.1.25
    - Resolves: RHBZ#1922272

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0476 advisory.

    [5.0.103-1.0.1]
    - Add support for new Oracle release

    [5.0.103-1]
    - Update to .NET SDK 5.0.103 and Runtime 5.0.3
    - Resolves: RHBZ#1924765

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0471 advisory.

    [3.1.112-1.0.1]
    - Update patch to support 8.3 (alexander.burmashev@oracle.com)
    - support OL release scheme (alexander.burmashev@oracle.com)

    [3.1.112-1]
    - Update to .NET Core SDK 3.1.112 and Runtime 3.1.12
    - Resolves: RHBZ#1923377

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1639)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-1721)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0471 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 3.1.112 and .NET Core Runtime 3.1.12.

    Security Fix(es):

    * dotnet: certificate chain building recursion Denial of Service (CVE-2021-1721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0472 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 3.1.112 and .NET Core Runtime 3.1.12.

    Security Fix(es):

    * dotnet: certificate chain building recursion Denial of Service (CVE-2021-1721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0476 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.103 and .NET Runtime 5.0.3.

    Security Fix(es):

    * dotnet: certificate chain building recursion Denial of Service (CVE-2021-1721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0473 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.103 and .NET Runtime 5.0.3.

    Security Fix(es):

    * dotnet: certificate chain building recursion Denial of Service (CVE-2021-1721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0470 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 2.1.521 and .NET Core Runtime 2.1.25.

    Security Fix(es):

    * dotnet: certificate chain building recursion Denial of Service (CVE-2021-1721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0474 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 2.1.521 and .NET Core Runtime 2.1.25.

    Security Fix(es):

    * dotnet: certificate chain building recursion Denial of Service (CVE-2021-1721)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service vulnerability exists in .NET Core when creating HTTPS web requests during X509     certificate chain building. An unauthenticated, remote attacker can exploit this to cause the application     to stop responding. (CVE-2021-1721)

  - A remote code execution vulnerability exists in .NET Core when parsing certain types of graphics files. An     unauthenticated, remote attacker can exploit this to execute arbitrary code. This vulnerability only     exists on systems running on macOS or Linux. (CVE-2021-24112)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x prior to 2.1.521, 2.1.6xx prior to 2.1.813, 3.1.x prior to 3.1.112, 3.1.2xx prior to 3.1.406, or 5.x prior to 5.0.103. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated, remote attacker can exploit this to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft ASP.NET Core installation on the remote host is version 2.1.x prior to 2.1.25, 3.1.x prior to 3.1.126, or 5.x prior to 5.0.3. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated, remote attacker can exploit this to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installation on the remote host is version 2.1.x prior to 2.1.25, 3.1.x prior to 3.1.126, or 5.x prior to 5.0.3. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated, remote attacker can exploit this to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	high
150708	Security Update for .NET Core (June 2021)	Nessus	Windows	medium
150707	Security Update for .NET Core (June 2021) (macOS)	Nessus	MacOS X Local Security Checks	medium
146856	Fedora 32 : dotnet3.1 (2021-48ca39b6ad)	Nessus	Fedora Local Security Checks	critical
146854	Fedora 33 : dotnet3.1 (2021-c3d7fc8949)	Nessus	Fedora Local Security Checks	critical
146828	Fedora 32 : dotnet5.0 (2021-56e894d5ca)	Nessus	Fedora Local Security Checks	critical
146691	Fedora 33 : dotnet5.0 (2021-b881ee9839)	Nessus	Fedora Local Security Checks	critical
146546	Oracle Linux 8 : dotnet (ELSA-2021-0474)	Nessus	Oracle Linux Local Security Checks	medium
146441	Oracle Linux 8 : dotnet5.0 (ELSA-2021-0476)	Nessus	Oracle Linux Local Security Checks	medium
146438	Oracle Linux 8 : dotnet3.1 (ELSA-2021-0471)	Nessus	Oracle Linux Local Security Checks	medium
146426	Security Updates for Microsoft Visual Studio Products (February 2021)	Nessus	Windows : Microsoft Bulletins	high
146383	RHEL 8 : dotnet3.1 (RHSA-2021:0471)	Nessus	Red Hat Local Security Checks	medium
146382	RHEL 7 : .NET Core 3.1 on Red Hat Enterprise Linux (RHSA-2021:0472)	Nessus	Red Hat Local Security Checks	medium
146381	RHEL 8 : dotnet5.0 (RHSA-2021:0476)	Nessus	Red Hat Local Security Checks	medium
146380	RHEL 7 : .NET 5.0 on Red Hat Enterprise Linux (RHSA-2021:0473)	Nessus	Red Hat Local Security Checks	medium
146379	RHEL 7 : .NET Core 2.1 on Red Hat Enterprise Linux (RHSA-2021:0470)	Nessus	Red Hat Local Security Checks	medium
146378	RHEL 8 : dotnet (RHSA-2021:0474)	Nessus	Red Hat Local Security Checks	medium
146347	Security Update for .NET Core (February 2021) (macOS)	Nessus	MacOS X Local Security Checks	critical
146346	Security Update for .NET Core SDK (February 2021)	Nessus	Windows	medium
146344	Security Update for Microsoft ASP.NET Core (February 2021)	Nessus	Windows	medium
146328	Security Update for .NET Core (February 2021)	Nessus	Windows	medium

Detections

Analytics

CVE-2021-1721

medium

Tenable Plugins

high

medium

medium

critical

critical

critical

critical

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium