.NET Core Remote Code Execution Vulnerability

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1574:03 advisory.

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dotnet package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - .NET Core Remote Code Execution Vulnerability (CVE-2021-24112)

The 8.4.0 versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net (.NET Core)).
    Supported versions that are affected are 8.4.0 and prior. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.
    Successful attacks of this vulnerability can result in takeover of MySQL Connectors. (CVE-2021-24112)

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported     versions that are affected are 8.4.0 and prior. Easily exploitable vulnerability allows low privileged     attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors     accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data and     unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors.
    (CVE-2024-21170)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48ca39b6ad advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-c3d7fc8949 advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-56e894d5ca advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-b881ee9839 advisory.

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2021-1721)

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701. (CVE-2021-24112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service vulnerability exists in .NET Core when creating HTTPS web requests during X509     certificate chain building. An unauthenticated, remote attacker can exploit this to cause the application     to stop responding. (CVE-2021-1721)

  - A remote code execution vulnerability exists in .NET Core when parsing certain types of graphics files. An     unauthenticated, remote attacker can exploit this to execute arbitrary code. This vulnerability only     exists on systems running on macOS or Linux. (CVE-2021-24112)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
293992	MiracleLinux 8 : dotnet5.0-5.0.104-1.0.1.el8 (AXSA:2021-1574:03)	Nessus	Miracle Linux Local Security Checks	Local	critical
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	Local	high
418991	SCA: security update for System.Drawing.Common (GHSA-rxg9-xrhp-64gj)	Tenable Cloud Security	SCA Checks	Local	critical
418991	SCA: security update for System.Drawing.Common (GHSA-rxg9-xrhp-64gj)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
204715	Oracle MySQL Connectors (Jul 2024 CPU)	Nessus	Misc.	Local	medium
146856	Fedora 32 : dotnet3.1 (2021-48ca39b6ad)	Nessus	Fedora Local Security Checks	Local	critical
146854	Fedora 33 : dotnet3.1 (2021-c3d7fc8949)	Nessus	Fedora Local Security Checks	Local	critical
146828	Fedora 32 : dotnet5.0 (2021-56e894d5ca)	Nessus	Fedora Local Security Checks	Local	critical
146691	Fedora 33 : dotnet5.0 (2021-b881ee9839)	Nessus	Fedora Local Security Checks	Local	critical
146347	Security Update for .NET Core (February 2021) (macOS)	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2021-24112

critical

Tenable Plugins

critical

high

critical

critical

medium

critical

critical

critical

critical

critical