Bug 1933740 (CVE-2021-26701)

Summary:	CVE-2021-26701 dotnet: System.Text.Encodings.Web Remote Code Execution
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	andrew.slice, bodavis, dbhole, kanderso, maltron, omajid, rtillery, rwagner, scorneli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A remote code execution vulnerability was found in dotnet in the System.Text.Encodings.Web package, caused by a buffer overrun. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-09 21:06:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1933333, 1933375, 1933844, 1933845, 1934240, 1934247
Bug Blocks:	1933745

Description Marian Rehak 2021-03-01 15:29:16 UTC

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Reference:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26701

Comment 9 Marian Rehak 2021-03-09 09:17:59 UTC

Hello RaTasha,

The Microsoft advisory is quite sparse. Please read comment #2 by Omair Majid. RCE means the attacker's possibilities might to do damage might be very expanded including the compromise to all three C/I/A.

Comment 10 Stefan Cornelius 2021-03-09 18:25:42 UTC

External References:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26701
https://github.com/dotnet/announcements/issues/178

Comment 12 errata-xmlrpc 2021-03-09 20:09:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0790 https://access.redhat.com/errata/RHSA-2021:0790

Comment 13 errata-xmlrpc 2021-03-09 20:09:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0788 https://access.redhat.com/errata/RHSA-2021:0788

Comment 14 errata-xmlrpc 2021-03-09 20:33:58 UTC

This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2021:0787 https://access.redhat.com/errata/RHSA-2021:0787

Comment 15 errata-xmlrpc 2021-03-09 20:34:38 UTC

This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2021:0789 https://access.redhat.com/errata/RHSA-2021:0789

Comment 16 errata-xmlrpc 2021-03-09 20:48:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0793 https://access.redhat.com/errata/RHSA-2021:0793

Comment 17 Product Security DevOps Team 2021-03-09 21:06:15 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-26701

Comment 18 errata-xmlrpc 2021-03-09 21:13:59 UTC

This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2021:0794 https://access.redhat.com/errata/RHSA-2021:0794