CVE-2021-31957
ASP.NET Core Denial of Service Vulnerability
Impact
# Withdrawn This advisory was initially published and mapped incorrectly to nuget `Microsoft.NETCore.App.Ref`. We later reanalyzed this advisory and found it does not have a direct mapping to a NuGet package. Thus we have withdrawn this advisory. The underlying ASP.NET Core Denial of Service Vulnerability and CVE-2021-31957 remain legitimate. # Description. Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists when ASP.NET Core improperly handles client disconnect. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. ### Patches * If you're using .NET 5.0, you should download and install Runtime 5.0.7 or SDK 5.0.204 (for Visual Studio 2019 v16.8) or SDK 5.0.301 (for Visual Studio 2019 16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0. * If you're using .NET Core 3.1, you should download and install Runtime 3.1.16 or SDK 3.1.116 (for Visual Studio 2019 v16.4) or 3.1.410 (for Visual Studio 2019 v16.5 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1. #### Other Details - Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/188 - An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/33369 - MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App.Ref | < 3.1.16 | 3.1.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net | from 5.0 through 5.0.6 |
| Microsoft | .Net Core | from 3.1 through 3.1.15 |
| Microsoft | Visual Studio 2019 | from 16.0 through 16.10 Version 8.10 |
| Fedoraproject | Fedora | Versions 33, 34 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4PRVVLXXQEF4SEJOBV3VRJHGX7YHY2CG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVCDYIP4A6DDRT7G6P3ZW6PKNK2DNWJ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMHWHRRYDHKM6BIINW5V7OCSW4SDWB4W/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMAO4NG2OQ4PCXUQWMNSCMYWLIJJY6UY/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31957
- https://github.com/advisories/GHSA-mcwm-2wmc-6hv4
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-mcwm-2wmc-6hv4
- https://nvd.nist.gov/vuln/detail/CVE-2021-31957
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4PRVVLXXQEF4SEJOBV3VRJHGX7YHY2CG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVCDYIP4A6DDRT7G6P3ZW6PKNK2DNWJ2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PMHWHRRYDHKM6BIINW5V7OCSW4SDWB4W/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMAO4NG2OQ4PCXUQWMNSCMYWLIJJY6UY/