medium6.5
CVE-2021-1721
Denial of service in .NET core
Impact
.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App | >= 2.1.0, < 2.1.25 | 2.1.25 |
| nuget | Microsoft.NETCore.App.Host.linux-arm | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-arm64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-musl-arm64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-musl-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.linux-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.osx-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.rhel.6-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-arm | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-arm64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Host.win-x86 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.linux-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.osx-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.rhel.6-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.win-arm64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.win-x64 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.win-x86 | >= 3.1.0, < 3.1.12 | 3.1.12 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-arm | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-arm64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.linux-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.Mono.osx-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-arm | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-arm64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.android-x86 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.browser-wasm | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.ios-arm | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.ios-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.ios-x86 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.tvos-arm64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
| nuget | Microsoft.NETCore.App.Runtime.tvos-x64 | >= 5.0.0, < 5.0.3 | 5.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net | from 5.0 through 5.0.2 |
| Microsoft | .Net Core | from 2.1 through 2.1.24 from 3.1 through 3.1.11 |
| Microsoft | Powershell Core | Versions 7.0, 7.1 |
| Microsoft | Visual Studio 2017 | from 15.0 through 15.9 |
| Microsoft | Visual Studio 2019 | from 16.0 through 16.8 |
References
- NVD record
- CVE.org record
- GitHub advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1721
- https://github.com/advisories/GHSA-3gp9-h8hw-pxpw
- https://nvd.nist.gov/vuln/detail/CVE-2021-1721
- https://github.com/dotnet/announcements/issues/175
- https://github.com/dotnet/runtime/issues/48067