GHSA-ghhp-997w-qr28

Source

https://github.com/advisories/GHSA-ghhp-997w-qr28

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-ghhp-997w-qr28/GHSA-ghhp-997w-qr28.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-ghhp-997w-qr28

Aliases

Published

2021-04-21T19:38:01Z

Modified

2024-12-07T05:45:57.337833Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

.NET Core Remote Code Execution Vulnerability

Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Discussion

Discussion for this issue can be found at dotnet/runtime#49377

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name | Vulnerable Versions | Secure Versions -|-|- System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 System.Text.Encodings.Web | 5.0.0 | 5.0.1

Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

Database specific

{
    "nvd_published_at": "2021-02-25T23:15:00Z",
    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-21T19:37:39Z"
}

References

Affected packages

NuGet / System.Text.Encodings.Web

Package

Name: System.Text.Encodings.Web; View open source insights on deps.dev
Purl: pkg:nuget/System.Text.Encodings.Web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.5.1

Affected versions

4.*

4.0.0

4.0.1

4.3.0-preview1-24530-04

4.3.0

4.3.1

4.4.0-preview1-25305-02

4.4.0-preview2-25405-01

4.4.0

4.5.0-preview1-26216-02

4.5.0-preview2-26406-04

4.5.0-rc1

4.5.0

NuGet / System.Text.Encodings.Web

Package

Name: System.Text.Encodings.Web; View open source insights on deps.dev
Purl: pkg:nuget/System.Text.Encodings.Web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.6.0

Fixed

4.7.2

Affected versions

4.*

4.6.0

4.7.0

4.7.1

NuGet / System.Text.Encodings.Web

Package

Name: System.Text.Encodings.Web; View open source insights on deps.dev
Purl: pkg:nuget/System.Text.Encodings.Web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.1

Affected versions

5.*

5.0.0