CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
88.1%
Severity: High
Date : 2021-03-25
CVE-ID : CVE-2021-1721 CVE-2021-1723 CVE-2021-24112
Package : dotnet-sdk
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1449
The package dotnet-sdk before version 5.0.3.sdk103-2 is vulnerable to
multiple issues including arbitrary code execution and denial of
service.
Upgrade to 5.0.3.sdk103-2.
The problems have been fixed upstream in version 5.0.3.sdk103.
None.
A security issue was found in dotnet-core before version 3.1.12. A
denial-of-service vulnerability exists when creating HTTPS web request
during X509 certificate chain building.
A flaw was found in dotnet-core before version 3.1.11. Running
callbacks outside of locks results in Krestel deadlock using HTTP2.
A remote code execution vulnerability exists in dotnet-core before
version 3.1.12 when parsing certain types of graphics files. This
vulnerability only exists on systems running on MacOS or Linux.
A malicious client can send crafted HTTP requests and crash the server,
or execute arbitrary code by reading a crafted file.
https://bugs.archlinux.org/task/69317
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1721
https://github.com/dotnet/announcements/issues/175
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723
https://github.com/dotnet/announcements/issues/170
https://github.com/dotnet/aspnetcore/commit/20ad9fa5dcde635c13c6c83806c4701d5b7ec21e
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24112
https://github.com/dotnet/announcements/issues/176
https://security.archlinux.org/CVE-2021-1721
https://security.archlinux.org/CVE-2021-1723
https://security.archlinux.org/CVE-2021-24112
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | dotnet-sdk | < 5.0.3.sdk103-2 | UNKNOWN |
bugs.archlinux.org/task/69317
github.com/dotnet/announcements/issues/170
github.com/dotnet/announcements/issues/175
github.com/dotnet/announcements/issues/176
github.com/dotnet/aspnetcore/commit/20ad9fa5dcde635c13c6c83806c4701d5b7ec21e
msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1721
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24112
security.archlinux.org/AVG-1449
security.archlinux.org/CVE-2021-1721
security.archlinux.org/CVE-2021-1723
security.archlinux.org/CVE-2021-24112
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
88.1%