ASP.NET Core Denial of Service Vulnerability

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2353 advisory.

  - ASP.NET Denial of Service Vulnerability (CVE-2021-31957)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2352 advisory.

  - ASP.NET Denial of Service Vulnerability (CVE-2021-31957)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio 2019 runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a denial of service vulnerability. When a .NET application utilizing libgdiplus on a non-Windows system accepts input, an attacker could send a specially crafted request that could result in application crashes.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2352 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.116 and .NET Runtime 3.1.16.

    Security Fix(es):

    * dotnet: ASP.NET Core Client Disconnect Denial of Service (CVE-2021-31957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2353 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.204 and .NET Runtime 5.0.7.

    Security Fix(es):

    * dotnet: ASP.NET Core Client Disconnect Denial of Service (CVE-2021-31957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2352 advisory.

    [3.1.116-1.0.1]
    - Update patch to support 8.3 (alexander.burmashev@oracle.com)
    - support OL release scheme (alexander.burmashev@oracle.com)

    [3.1.116-1]
    - Update to .NET SDK 3.1.116 and Runtime 3.1.16
    - Resolves: RHBZ#1965505

    [3.1.115-1]
    - Update to .NET SDK 3.1.115 and Runtime 3.1.15
    - Resolves: RHBZ#1954333

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2353 advisory.

    [5.0.204-1.0.1]
    - Add support for new Oracle release

    [5.0.204-1]
    - Update to .NET SDK 5.0.204 and Runtime 5.0.7
    - Resolves: RHBZ#1966166

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing a security update. They are, therefore, affected by a denial of service (DoS) vulnerability due to improper handling of client connections. An unauthenticated, remote attacker can exploit this issue to cause the applications to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2351 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 5.0.204 and .NET Runtime 5.0.7.

    Security Fix(es):

    * dotnet: ASP.NET Core Client Disconnect Denial of Service (CVE-2021-31957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2350 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.116 and .NET Runtime 3.1.16.

    Security Fix(es):

    * dotnet: ASP.NET Core Client Disconnect Denial of Service (CVE-2021-31957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installation on the remote host is version 3.1.x prior to 3.1.116, 3.1.2xx prior to 3.1.410, 5.x prior to 5.0.204, or 5.0.3xx prior to 5.0.301. It is, therefore, affected by a denial of service vulnerability. An unauthenticated, remote attacker can exploit this to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
157836	Rocky Linux 8 : .NET 5.0 (RLSA-2021:2353)	Nessus	Rocky Linux Local Security Checks	medium
157779	Rocky Linux 8 : .NET Core 3.1 (RLSA-2021:2352)	Nessus	Rocky Linux Local Security Checks	medium
150988	Security Update for Visual Studio 2019 (June 2021) (macOS)	Nessus	MacOS X Local Security Checks	medium
150820	RHEL 8 : .NET Core 3.1 (RHSA-2021:2352)	Nessus	Red Hat Local Security Checks	medium
150818	RHEL 8 : .NET 5.0 (RHSA-2021:2353)	Nessus	Red Hat Local Security Checks	medium
150725	Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2021-2352)	Nessus	Oracle Linux Local Security Checks	medium
150495	Oracle Linux 8 : .NET / 5.0 (ELSA-2021-2353)	Nessus	Oracle Linux Local Security Checks	medium
150418	Security Updates for Microsoft Visual Studio Products (June 2021)	Nessus	Windows : Microsoft Bulletins	medium
150387	RHEL 7 : .NET 5.0 on RHEL 7 (RHSA-2021:2351)	Nessus	Red Hat Local Security Checks	medium
150386	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2021:2350)	Nessus	Red Hat Local Security Checks	medium
150365	Security Update for .NET Core SDK (June 2021)	Nessus	Windows	medium

Detections

Analytics

CVE-2021-31957

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium