Description
.NET Core Remote Code Execution Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | .NET Core 2.1 | 2.1 – < publication | publication |
| Microsoft | .NET Core 3.1 | 3.1 – < publication | publication |
| Microsoft | .NET 5.0 | 5.0.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | 16.0.0 – < publication | publication |
| Microsoft | Visual Studio 2019 for Mac | 8.0.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.8 (includes 16.0 - 16.7) | 16.0 – < publication | publication |
| Microsoft | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | 15.0.0 – < publication | publication |
| Microsoft | PowerShell Core 7.1 | 7.1.0 – < publication | publication |
| Microsoft | PowerShell Core 7.0 | 7.0.0 – < publication | publication |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | dotnet +2 | 2.1.522-1.el8_3 | RHSA-2021:0793, RHSA-2021:0788 |
| RHEL 8 | dotnet-host +6 | 5.0.4-1.el8_3 | RHSA-2021:0793 |
| RHEL 8 | dotnet-hostfxr-3.1 +5 | 3.1.13-1.el8_3 | RHSA-2021:0790 |
| RHEL 8 | dotnet-runtime-2.1 +1 | 2.1.26-1.el8_3 | RHSA-2021:0788 |
| RHEL 8 | dotnet3.1 +2 | 3.1.113-1.el8_3 | RHSA-2021:0790 |
| RHEL 8 | dotnet5.0 +3 | 5.0.104-1.el8_3 | RHSA-2021:0793 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet +3 | 5.0.104-1.el7_9 | RHSA-2021:0794 |
| Red Hat Rhel Dotnet 5 | rh-dotnet50-dotnet-host +6 | 5.0.4-1.el7_9 | RHSA-2021:0794 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet +3 | 3.1.113-1.el7_9 | RHSA-2021:0789 |
| Red Hat Rhel Dotnet 3 | rh-dotnet31-dotnet-host +6 | 3.1.13-1.el7_9 | RHSA-2021:0789 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21 +1 | 2.1-25.el7_9 | RHSA-2021:0787 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21-dotnet +2 | 2.1.522-1.el7_9 | RHSA-2021:0787 |
| Red Hat Rhel Dotnet 2 | rh-dotnet21-dotnet-host +1 | 2.1.26-1.el7_9 | RHSA-2021:0787 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | dotnet +3 | 5.0.104-1.0.1.el8_3 | ELSA-2021-0793 |
| Oracle Linux 8 | dotnet-host +6 | 5.0.4-1.0.1.el8_3 | ELSA-2021-0793 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 +5 | 3.1.13-1.0.1.el8_3 | ELSA-2021-0790 |
| Oracle Linux 8 | dotnet-runtime-2.1 +1 | 2.1.26-1.el8_3 | ELSA-2021-0788 |
| Oracle Linux 8 | dotnet-sdk-2.1 +1 | 2.1.522-1.el8_3 | ELSA-2021-0788 |
| Oracle Linux 8 | dotnet-sdk-3.1 +1 | 3.1.113-1.0.1.el8_3 | ELSA-2021-0790 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | System.Text.Encodings.Web | >= 4.0.0, < 4.5.1 | 4.5.1 | GHSA-ghhp-997w-qr28 |
| NuGet | System.Text.Encodings.Web | >= 4.6.0, < 4.7.2 | 4.7.2 | GHSA-ghhp-997w-qr28 |
| NuGet | System.Text.Encodings.Web | >= 5.0.0, < 5.0.1 | 5.0.1 | GHSA-ghhp-997w-qr28 |
Advisories 9
- RHSA-2021:0794 Red Hat Security Advisory: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0790 Red Hat Security Advisory: dotnet3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0793 Red Hat Security Advisory: .NET Core on RHEL 8 security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0788 Red Hat Security Advisory: dotnet security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0789 Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0787 Red Hat Security Advisory: .NET Core 2.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- ELSA-2021-0793 Important: .NET Core on OL 8 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 11, 2021
- ELSA-2021-0790 Important: dotnet3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 10, 2021
- ELSA-2021-0788 Important: dotnet security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 10, 2021
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701
- FEDORA-2021-e2d218afe6 vendor-advisory
- FEDORA-2021-904d0bd496 vendor-advisory
- FEDORA-2021-1b22f31541 vendor-advisory
- FEDORA-2021-138728e59b vendor-advisory
- FEDORA-2021-3da33cdc80 vendor-advisory
- FEDORA-2021-265a3c7cb9 vendor-advisory