GHSA-ghhp-997w-qr28

Suggest an improvement
Source
https://github.com/advisories/GHSA-ghhp-997w-qr28
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-ghhp-997w-qr28/GHSA-ghhp-997w-qr28.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-ghhp-997w-qr28
Aliases
Published
2021-04-21T19:38:01Z
Modified
2024-02-22T05:22:44.340255Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
.NET Core Remote Code Execution Vulnerability
Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

Discussion

Discussion for this issue can be found at dotnet/runtime#49377

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name | Vulnerable Versions | Secure Versions -|-|- System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 System.Text.Encodings.Web | 5.0.0 | 5.0.1

Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

References

Affected packages

NuGet / System.Text.Encodings.Web

Package

Name
System.Text.Encodings.Web
View open source insights on deps.dev
Purl
pkg:nuget/System.Text.Encodings.Web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.5.1

Affected versions

4.*

4.0.0
4.0.1
4.3.0-preview1-24530-04
4.3.0
4.3.1
4.4.0-preview1-25305-02
4.4.0-preview2-25405-01
4.4.0
4.5.0-preview1-26216-02
4.5.0-preview2-26406-04
4.5.0-rc1
4.5.0

NuGet / System.Text.Encodings.Web

Package

Name
System.Text.Encodings.Web
View open source insights on deps.dev
Purl
pkg:nuget/System.Text.Encodings.Web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.6.0
Fixed
4.7.2

Affected versions

4.*

4.6.0
4.7.0
4.7.1

NuGet / System.Text.Encodings.Web

Package

Name
System.Text.Encodings.Web
View open source insights on deps.dev
Purl
pkg:nuget/System.Text.Encodings.Web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.0.1

Affected versions

5.*

5.0.0