.NET Core Remote Code Execution Vulnerability

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-265a3c7cb9 advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-3da33cdc80 advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-138728e59b advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-1b22f31541 advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installation on the remote host is version 2.1.x prior to 2.1.26, 3.1.x prior to 3.1.13, or 5.x prior to 5.0.4. It is, therefore, affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0793 advisory.

    [5.0.104-1.0.1]
    - Add support for new Oracle release

    [5.0.104-1]
    - Update to .NET SDK 5.0.104 and Runtime 5.0.4
    - Resolves: RHBZ#1934247

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0790 advisory.

    [3.1.113-1.0.1]
    - Update patch to support 8.3 (alexander.burmashev@oracle.com)
    - support OL release scheme (alexander.burmashev@oracle.com)

    [3.1.113-1]
    - Update to .NET Core SDK 3.1.113 and Runtime 3.1.13
    - Resolves: RHBZ#1933845

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0788 advisory.

    [2.1.522-1]
    - Update to .NET Core SDK 2.1.522 and Runtime 2.1.26
    - Resolves: RHBZ#1933844

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0790 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 3.1.113 and .NET Core Runtime 3.1.13.

    Security Fix(es):

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0793 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.104 and .NET Runtime 5.0.4.

    Security Fix(es):

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0787 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 2.1.522 and .NET Core Runtime 2.1.26.

    Security Fix(es):

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0789 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 3.1.113 and .NET Core Runtime 3.1.13.

    Security Fix(es):

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0794 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET     framework APIs and several new APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.104 and .NET Runtime 5.0.4.

    Security Fix(es):

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.v

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0788 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 2.1.522 and .NET Core Runtime 2.1.26.

    Security Fix(es):

    * dotnet: System.Text.Encodings.Web Remote Code Execution (CVE-2021-26701)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
148198	Fedora 32 : dotnet3.1 (2021-265a3c7cb9)	Nessus	Fedora Local Security Checks	critical
148197	Fedora 33 : dotnet3.1 (2021-3da33cdc80)	Nessus	Fedora Local Security Checks	critical
148174	Fedora 32 : dotnet5.0 (2021-138728e59b)	Nessus	Fedora Local Security Checks	critical
147957	Fedora 33 : dotnet5.0 (2021-1b22f31541)	Nessus	Fedora Local Security Checks	critical
147946	Security Update for .NET Core (March 2021)	Nessus	Windows	critical
147655	Oracle Linux 8 : .NET / Core / on / OL / 8 (ELSA-2021-0793)	Nessus	Oracle Linux Local Security Checks	critical
147646	Oracle Linux 8 : dotnet3.1 (ELSA-2021-0790)	Nessus	Oracle Linux Local Security Checks	critical
147641	Oracle Linux 8 : dotnet (ELSA-2021-0788)	Nessus	Oracle Linux Local Security Checks	critical
147365	RHEL 8 : dotnet3.1 (RHSA-2021:0790)	Nessus	Red Hat Local Security Checks	critical
147236	RHEL 8 : .NET Core on RHEL 8 (RHSA-2021:0793)	Nessus	Red Hat Local Security Checks	critical
147235	RHEL 7 : .NET Core 2.1 on Red Hat Enterprise Linux (RHSA-2021:0787)	Nessus	Red Hat Local Security Checks	critical
147234	RHEL 7 : .NET Core 3.1 on Red Hat Enterprise Linux (RHSA-2021:0789)	Nessus	Red Hat Local Security Checks	critical
147233	RHEL 7 : .NET 5.0 on Red Hat Enterprise Linux (RHSA-2021:0794)	Nessus	Red Hat Local Security Checks	critical
147232	RHEL 8 : dotnet (RHSA-2021:0788)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2021-26701

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical