CVE-2021-34485 — .NET Core and Visual Studio Information Disclosure Vulnerability

Description

.NET Core and Visual Studio Information Disclosure Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	.NET 5.0	5.0.0 – < 5.0.9	5.0.9
Microsoft	.NET Core 2.1	2.1 – < 2.1.30	2.1.30
Microsoft	.NET Core 3.1	3.1 – < 3.1.18	3.1.18
Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)	15.9.0 – < 15.9.38	15.9.38
Microsoft	Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9)	16.10.0 – < 16.10.5	16.10.5
Microsoft	Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	16.0 – < 16.4.25	16.4.25
Microsoft	Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)	16.0.0 – < 16.7.18	16.7.18
Microsoft	Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)	15.0.0 – < 16.9.10	16.9.10
Microsoft	PowerShell 7.0	7.0.0 – < 7.0.7	7.0.7
Microsoft	PowerShell 7.1	7.1.0 – < 7.1.4	7.1.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 8	dotnet +2	2.1.525-1.el8_4	RHSA-2021:3148, RHSA-2021:3145
RHEL 8	dotnet-host +6	5.0.9-1.el8_4	RHSA-2021:3148
RHEL 8	dotnet-hostfxr-3.1 +5	3.1.18-1.el8_4	RHSA-2021:3142
RHEL 8	dotnet-runtime-2.1 +1	2.1.29-1.el8_4	RHSA-2021:3145
RHEL 8	dotnet3.1 +2	3.1.118-1.el8_4	RHSA-2021:3142
RHEL 8	dotnet5.0 +3	5.0.206-1.el8_4	RHSA-2021:3148

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Dotnet 5	rh-dotnet50-dotnet +3	5.0.206-1.el7_9	RHSA-2021:3147
Red Hat Rhel Dotnet 5	rh-dotnet50-dotnet-host +6	5.0.9-1.el7_9	RHSA-2021:3147
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet +3	3.1.118-1.el7_9	RHSA-2021:3143
Red Hat Rhel Dotnet 3	rh-dotnet31-dotnet-host +6	3.1.18-1.el7_9	RHSA-2021:3143
Red Hat Rhel Dotnet 2	rh-dotnet21 +1	2.1-28.el7_9	RHSA-2021:3144
Red Hat Rhel Dotnet 2	rh-dotnet21-dotnet +2	2.1.525-1.el7_9	RHSA-2021:3144
Red Hat Rhel Dotnet 2	rh-dotnet21-dotnet-host +1	2.1.29-1.el7_9	RHSA-2021:3144

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	dotnet +3	5.0.206-1.0.1.el8_4	ELSA-2021-3148
Oracle Linux 8	dotnet-host +6	5.0.9-1.0.1.el8_4	ELSA-2021-3148
Oracle Linux 8	dotnet-hostfxr-3.1 +5	3.1.18-1.0.1.el8_4	ELSA-2021-3142
Oracle Linux 8	dotnet-runtime-2.1 +1	2.1.29-1.el8_4	ELSA-2021-3145
Oracle Linux 8	dotnet-sdk-2.1 +1	2.1.525-1.el8_4	ELSA-2021-3145
Oracle Linux 8	dotnet-sdk-3.1 +1	3.1.118-1.0.1.el8_4	ELSA-2021-3142

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.NETCore.App	>= 2.1.0, < 2.1.29	2.1.29	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-arm	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-arm	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-arm64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-x64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.linux-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-arm	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.linux-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.Mono.osx-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.osx-x64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.osx-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.rhel.6-x64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-arm	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-arm	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-x64	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-x64	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-x86	>= 3.1.0, < 3.1.18	3.1.18	GHSA-vgwq-hfqc-58wv
NuGet	Microsoft.NETCore.App.Runtime.win-x86	>= 5.0.0, < 5.0.9	5.0.9	GHSA-vgwq-hfqc-58wv

Advisories 10

RHSA-2021:3148 Red Hat Security Advisory: .NET 5.0 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2021:3145 Red Hat Security Advisory: .NET Core 2.1 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2021:3147 Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2021:3143 Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2021:3144 Red Hat Security Advisory: .NET Core 2.1 on Red Hat Enterprise Linux security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2021:3142 Red Hat Security Advisory: .NET Core 3.1 security and bugfix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
MSRC-CVE-2021-34485 .NET Core and Visual Studio Information Disclosure Vulnerability Microsoft Security Response Center · Aug 19, 2021
ELSA-2021-3142 Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 13, 2021
ELSA-2021-3148 Important: .NET 5.0 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 13, 2021
ELSA-2021-3145 Low: .NET Core 2.1 security and bugfix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 12, 2021

References

.NET Core and Visual Studio Information Disclosure Vulnerability vendor-advisory patch

CNA	v3.1	5.0
EUVD	v3.1	5.0
OSV:GHSA	v3.1	5.5
CISA-ADP	v3.1	5.0