Sign-up

ID

VAR-202101-1406


CVE

CVE-2021-1723


TITLE

Microsoft ASP.NET Core and Visual Studio Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202101-809

DESCRIPTION

ASP.NET Core and Visual Studio Denial of Service Vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Advisory ID: RHSA-2021:0096-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:0096 Issue date: 2021-01-13 CVE Names: CVE-2021-1723 ===================================================================== 1. Summary: An update for rh-dotnet50-dotnet is now available for .NET on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.102 and .NET Runtime 5.0.2. Security Fix(es): * dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2 (CVE-2021-1723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1914258 - CVE-2021-1723 dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2 6. Package List: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm x86_64: rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v. 7): Source: rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm x86_64: rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm x86_64: rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-1723 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIUAwUBX/8ENtzjgjWX9erEAQjh5A/2IdPxRp4QSVH27LBp52uli+P8iYNYUQzJ oSP0BhxXlPnwty70y6h3XF04F2AgWdqddLa07e/lQo/tZfD4x8a7N5qJzCd3AaHy bhQaw5Rs2Yi/JM3l7nJbwL3kMnQ6+rg/w9IZG0JLPjEnURlcJmIArgIuNmWPBoxP GRVhNlEohEwbQhgwwp0PJkIhX9MxvpVT0OPbcUV6TGox65X+b8kMuUfjRhuKdEge l97WHuXTXa6QZMgaH28lSe8Vo6tkhzH89UEgo4CweybzptzPEgNfD4GOfpOrt9HG iqiRhMnpVrfp+nqet1k+seBfjeTkMfZBmrGR8nsU69rCqG85gWvtuT5j5ba5PWRg hHAg/bG4zIRlvRgIgTD00wVkGL0DC4zE/iI3bXZ7ATdl8pCADi1+uRyBwshbjbvL jFo8RrHE4DCtM1+X0jJhPnED3tMQmNQkmYd/sUzj6dM1OfYUFu6CDnyqOo9wIPkD yYTKp1/2lM8eJDtihM4vRRtfBUicagPAQ7Qu52VjDs9PwtSAReDE0FAnnfqfoRqt FXwdqez+GIpc6JgVp+wgof9zY3mq+MKS3WKZwt+v7KUbsSrg0sQTYpuMI+JFjG9l ZzAeU/ifax0HbO4R3rz2evVsT4yLGcSW7Yb/cTuPypLMFojFpSDzpkODfw3TGArj allfL6TeAQ== =fmd6 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.35

sources: NVD: CVE-2021-1723 // VULMON: CVE-2021-1723 // PACKETSTORM: 160935 // PACKETSTORM: 160946 // PACKETSTORM: 160930 // PACKETSTORM: 160934

AFFECTED PRODUCTS

vendor:microsoftmodel:asp.net corescope:lteversion:3.1.10

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:33

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:32

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:lteversion:5.0.1

Trust: 1.0

vendor:microsoftmodel:visual studio 2019scope:lteversion:16.8

Trust: 1.0

vendor:microsoftmodel:visual studio 2019scope:gteversion:16.0

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:gteversion:5.0

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:gteversion:3.1

Trust: 1.0

sources: NVD: CVE-2021-1723

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1723
value: HIGH

Trust: 1.0

secure@microsoft.com: CVE-2021-1723
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202101-809
value: HIGH

Trust: 0.6

VULMON: CVE-2021-1723
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1723
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

nvd@nist.gov: CVE-2021-1723
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

sources: VULMON: CVE-2021-1723 // CNNVD: CNNVD-202101-809 // NVD: CVE-2021-1723 // NVD: CVE-2021-1723

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2021-1723

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202101-809

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202101-809

PATCH

title:Microsoft ASP.NET Core and Visual Studio Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=139337

Trust: 0.6

title:Red Hat: Important: dotnet5.0 security and bugfix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20210094 - Security Advisory

Trust: 0.1

title:Red Hat: Important: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20210114 - Security Advisory

Trust: 0.1

title:Red Hat: Important: dotnet3.1 security and bugfix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20210095 - Security Advisory

Trust: 0.1

title:Red Hat: Important: .NET 5.0 on Red Hat Enterprise Linux security and bugfix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20210096 - Security Advisory

Trust: 0.1

title:Arch Linux Advisories: [ASA-202103-17] dotnet-sdk: multiple issuesurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-202103-17

Trust: 0.1

title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2021-1723 log

Trust: 0.1

title:Arch Linux Advisories: [ASA-202103-16] dotnet-runtime: multiple issuesurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-202103-16

Trust: 0.1

sources: VULMON: CVE-2021-1723 // CNNVD: CNNVD-202101-809

EXTERNAL IDS

db:NVDid:CVE-2021-1723

Trust: 2.1

db:PACKETSTORMid:160930

Trust: 0.7

db:AUSCERTid:ESB-2021.0129

Trust: 0.6

db:CNNVDid:CNNVD-202101-809

Trust: 0.6

db:VULMONid:CVE-2021-1723

Trust: 0.1

db:PACKETSTORMid:160935

Trust: 0.1

db:PACKETSTORMid:160946

Trust: 0.1

db:PACKETSTORMid:160934

Trust: 0.1

sources: VULMON: CVE-2021-1723 // PACKETSTORM: 160935 // PACKETSTORM: 160946 // PACKETSTORM: 160930 // PACKETSTORM: 160934 // CNNVD: CNNVD-202101-809 // NVD: CVE-2021-1723

REFERENCES

url:https://access.redhat.com/security/cve/cve-2021-1723

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2021-1723

Trust: 1.0

url:https://msrc.microsoft.com/update-guide/vulnerability/cve-2021-1723

Trust: 1.0

url:https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2021-1723

Trust: 0.7

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/rrxherxw4kr5wcp76udw5pc7gx3yqluw/

Trust: 0.6

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3l27cgrvewupelnjogtcw6gledbecb4b/

Trust: 0.6

url:https://vigilance.fr/vulnerability/microsoft-visual-studio-vulnerabilities-of-january-2021-34297

Trust: 0.6

url:https://msrc.microsoft.com/update-guide/vulnerability/cve-2020-17007/cve-2021-1723

Trust: 0.6

url:https://packetstormsecurity.com/files/160930/red-hat-security-advisory-2021-0096-01.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/asp-net-core-denial-of-service-via-callbacks-34307

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.0129/

Trust: 0.6

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.4

url:https://bugzilla.redhat.com/):

Trust: 0.4

url:https://access.redhat.com/security/team/key/

Trust: 0.4

url:https://access.redhat.com/articles/11258

Trust: 0.4

url:https://access.redhat.com/security/team/contact/

Trust: 0.4

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.4

url:https://access.redhat.com/errata/rhsa-2021:0094

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/193942

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:0095

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:0114

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:0096

Trust: 0.1

sources: VULMON: CVE-2021-1723 // PACKETSTORM: 160935 // PACKETSTORM: 160946 // PACKETSTORM: 160930 // PACKETSTORM: 160934 // CNNVD: CNNVD-202101-809 // NVD: CVE-2021-1723

CREDITS

Red Hat

Trust: 1.0

sources: PACKETSTORM: 160935 // PACKETSTORM: 160946 // PACKETSTORM: 160930 // PACKETSTORM: 160934 // CNNVD: CNNVD-202101-809

SOURCES

db:VULMONid:CVE-2021-1723
db:PACKETSTORMid:160935
db:PACKETSTORMid:160946
db:PACKETSTORMid:160930
db:PACKETSTORMid:160934
db:CNNVDid:CNNVD-202101-809
db:NVDid:CVE-2021-1723

LAST UPDATE DATE

2024-10-09T22:43:25.951000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2021-1723date:2021-03-04T00:00:00
db:CNNVDid:CNNVD-202101-809date:2021-01-27T00:00:00
db:NVDid:CVE-2021-1723date:2024-10-08T17:15:27.613

SOURCES RELEASE DATE

db:VULMONid:CVE-2021-1723date:2021-01-12T00:00:00
db:PACKETSTORMid:160935date:2021-01-13T15:19:08
db:PACKETSTORMid:160946date:2021-01-13T23:19:30
db:PACKETSTORMid:160930date:2021-01-13T15:11:46
db:PACKETSTORMid:160934date:2021-01-13T15:18:53
db:CNNVDid:CNNVD-202101-809date:2021-01-12T00:00:00
db:NVDid:CVE-2021-1723date:2021-01-12T20:15:34.993