Search for packages
| purl | pkg:nuget/System.Text.Encodings.Web@4.0.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bd3c-1sg9-wfh2
Aliases: CVE-2021-26701 GHSA-ghhp-997w-qr28 |
.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. ### Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed. ### Discussion Discussion for this issue can be found at dotnet/runtime#49377 ### Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. ### Affected software The vulnerable package is `System.Text.Encodings.Web` . Upgrading your package and redeploying your app should be sufficient to address this vulnerability. Vulnerable package versions: Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below. Package Name | Vulnerable Versions | Secure Versions -|-|- System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 System.Text.Encodings.Web | 5.0.0 | 5.0.1 Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-axvm-3dh9-3kf6 | Improper Input Validation A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range. |
CVE-2017-0247
GHSA-6xh7-4v2w-36q6 |
| VCID-b2mg-kc6t-z7ht | Improper Input Validation A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. |
CVE-2017-0256
GHSA-j8f4-2w4p-mhjc |
| VCID-j4d8-wr24-63d3 | Improper Certificate Validation Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability." |
CVE-2017-0248
GHSA-ch6p-4jcm-h8vh |
| VCID-mrpr-pw4n-bfae | Improper Input Validation An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. |
CVE-2017-0249
GHSA-qhqf-ghgh-x2m4 |