CVE-2021-26701 – system.text.encodings.web

Package

Manager: nuget
Name: system.text.encodings.web
Vulnerable Version: =5.0.0 || >=4.0.0 <4.5.1 || >=4.6.0 <4.7.2

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.01745 pctl0.81809

Details

.NET Core Remote Code Execution Vulnerability .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. ### Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed. ### Discussion Discussion for this issue can be found at dotnet/runtime#49377 ### Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. ### Affected software The vulnerable package is `System.Text.Encodings.Web` . Upgrading your package and redeploying your app should be sufficient to address this vulnerability. Vulnerable package versions: Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below. Package Name | Vulnerable Versions | Secure Versions -|-|- System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 System.Text.Encodings.Web | 5.0.0 | 5.0.1 Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.

Metadata

Created: 2021-04-21T19:38:01Z
Modified: 2021-04-21T19:37:39Z
Source: MANUAL
CWE IDs: []
Alternative ID: GHSA-ghhp-997w-qr28
Finding: F184
Auto approve: 1