Bug 2011487 (CVE-2021-41355) - CVE-2021-41355 dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails
Summary: CVE-2021-41355 dotnet: System.DirectoryServices.Protocols.LdapConnection send...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-41355
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2012148 2012149 2012150 2013471 2014169
Blocks: 2011488
TreeView+ depends on / blocked
 
Reported: 2021-10-06 17:06 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-10-19 17:44 UTC (History)
13 users (show)

Fixed In Version: runtime 5.0.11, sdk 5.0.208
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in dotnet, where the System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if the Transport Layer Security (TLS) handshake fails. This flaw allows an attacker to intercept sensitive information. The highest threat from this vulnerability is to confidentiality.
Clone Of:
Environment:
Last Closed: 2021-10-12 20:08:23 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3818 0 None None None 2021-10-12 19:48:37 UTC
Red Hat Product Errata RHSA-2021:3819 0 None None None 2021-10-12 20:01:17 UTC

Description Guilherme de Almeida Suckevicz 2021-10-06 17:06:18 UTC 
It was discovered that System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if the TLS handshake failed. An attacker could exploit this to potentially intercept sensitive information.
Comment 3 errata-xmlrpc 2021-10-12 19:48:35 UTC 
This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2021:3818 https://access.redhat.com/errata/RHSA-2021:3818
Comment 4 errata-xmlrpc 2021-10-12 20:01:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3819 https://access.redhat.com/errata/RHSA-2021:3819
Comment 5 Product Security DevOps Team 2021-10-12 20:08:23 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-41355
Note You need to log in before you can comment on or make changes to this bug.