Bug 2011487 (CVE-2021-41355)
| Summary: | CVE-2021-41355 dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | andrew.slice, bodavis, crummel, dbhole, dotnet-packagers, francisco.vergarat, harold, kanderso, lvaleeva, omajid, rjanekov, rwagner, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | runtime 5.0.11, sdk 5.0.208 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in dotnet, where the System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if the Transport Layer Security (TLS) handshake fails. This flaw allows an attacker to intercept sensitive information. The highest threat from this vulnerability is to confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-12 20:08:23 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2012148, 2012149, 2012150, 2013471, 2014169 | ||
| Bug Blocks: | 2011488 | ||
|
Description
Guilherme de Almeida Suckevicz
2021-10-06 17:06:18 UTC
This issue has been addressed in the following products: .NET Core on Red Hat Enterprise Linux Via RHSA-2021:3818 https://access.redhat.com/errata/RHSA-2021:3818 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3819 https://access.redhat.com/errata/RHSA-2021:3819 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-41355 |