Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0129
.NET Core 3.1 and .NET 5.0 on Red Hat Enterprise Linux
security and bugfix update
14 January 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: .NET Core 3.1
.NET 5.0
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-1723
Reference: ASB-2021.0005
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:0114
https://access.redhat.com/errata/RHSA-2021:0096
Comment: This bulletin contains two (2) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update
Advisory ID: RHSA-2021:0114-01
Product: .NET Core on Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0114
Issue date: 2021-01-13
CVE Names: CVE-2021-1723
=====================================================================
1. Summary:
An update for rh-dotnet31-dotnet is now available for .NET Core on Red Hat
Enterprise Linux.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
.NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64
.NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64
3. Description:
.NET Core is a managed-software framework. It implements a subset of the
.NET framework APIs and several new APIs, and it includes a CLR
implementation.
New versions of .NET Core that address a security vulnerability are now
available. The updated versions are .NET Core SDK 3.1.111 and .NET Core
Runtime 3.1.11.
Security Fix(es):
* dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock
when using HTTP2 (CVE-2021-1723)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1914258 - CVE-2021-1723 dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2
6. Package List:
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
rh-dotnet31-dotnet-3.1.111-1.el7_9.src.rpm
x86_64:
rh-dotnet31-aspnetcore-runtime-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-apphost-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-debuginfo-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-host-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-hostfxr-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-runtime-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-sdk-3.1-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-targeting-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-templates-3.1-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-netstandard-targeting-pack-2.1-3.1.111-1.el7_9.x86_64.rpm
.NET Core on Red Hat Enterprise Linux Server (v. 7):
Source:
rh-dotnet31-dotnet-3.1.111-1.el7_9.src.rpm
x86_64:
rh-dotnet31-aspnetcore-runtime-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-apphost-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-debuginfo-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-host-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-hostfxr-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-runtime-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-sdk-3.1-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-targeting-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-templates-3.1-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-netstandard-targeting-pack-2.1-3.1.111-1.el7_9.x86_64.rpm
.NET Core on Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-dotnet31-dotnet-3.1.111-1.el7_9.src.rpm
x86_64:
rh-dotnet31-aspnetcore-runtime-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-aspnetcore-targeting-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-apphost-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-debuginfo-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-host-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-hostfxr-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-runtime-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-sdk-3.1-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-targeting-pack-3.1-3.1.11-1.el7_9.x86_64.rpm
rh-dotnet31-dotnet-templates-3.1-3.1.111-1.el7_9.x86_64.rpm
rh-dotnet31-netstandard-targeting-pack-2.1-3.1.111-1.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-1723
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBX/9GitzjgjWX9erEAQi/NQ//VjL2JStMg0IlMWrmm/tXRhF9AmuDy4jj
U1mDtwo05jgZtXNEHF3NPH1P49DKP5zW3qGMvpukJqx0XXCIauniXPyPZb1Y5yjX
D4gqbzasATjbhps6oGDYASs0Phn3/M0aIGLfN6HiUzA7erlztefyy0u+tzTVluDB
40viDmuAWiycRJHe7iaCdVm8YTUj3Byt672PspFcYdikEti6JfqA3TFq3rhKvm3R
p+uf1xZj3Db11uhSOUmma9LrmRbfl2e1MGR8bv95I2jRPDBfqEAFYbkYEZG3t3PQ
+PRZl74vZjVGOjkuc745Z8JrdX+COgVEgv6TbKNBZv6p/u8P0HSF+G9kJqaAP1vW
w+6N8YI9fMNwLChUdyVjCKm1Tnazwzyg643wafDZ/yHYcq3AuONYB6Wh0yG2+wUn
u8kiO4qOvpTB6lSvafaXaPPXjkdKjkrFy7KczJfbQnhjSsLGqWdtS6ulxernj/0t
tIKGezBos6whZ2b/6/bhRArNLiNjE2kTNVZhHWGdDnV4kSsri+2nTUcwrptA9JjN
UQhJVJRCYraL46rPzcO1LoW2fBV5GSq+iFJ5HnrFQdhibhg0jEm/t+Rklh95cJex
2z5HyUGvOvr9ry9MaQT3zvLTTbaL3WG0AIBi1KsKJCjbxnvyPSNncMotyeIZ39h8
I+sRgAK6Gko=
=Ej1o
- -----END PGP SIGNATURE-----
- ---------------------------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update
Advisory ID: RHSA-2021:0096-01
Product: .NET Core on Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0096
Issue date: 2021-01-13
CVE Names: CVE-2021-1723
=====================================================================
1. Summary:
An update for rh-dotnet50-dotnet is now available for .NET on Red Hat
Enterprise Linux.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
.NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64
.NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64
3. Description:
.NET is a managed-software framework. It implements a subset of the .NET
framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now
available. The updated versions are .NET SDK 5.0.102 and .NET Runtime
5.0.2.
Security Fix(es):
* dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock
when using HTTP2 (CVE-2021-1723)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1914258 - CVE-2021-1723 dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2
6. Package List:
.NET Core on Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm
x86_64:
rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm
.NET Core on Red Hat Enterprise Linux Server (v. 7):
Source:
rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm
x86_64:
rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm
.NET Core on Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-dotnet50-dotnet-5.0.102-1.el7_9.src.rpm
x86_64:
rh-dotnet50-aspnetcore-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-aspnetcore-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-apphost-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-debuginfo-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-host-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-hostfxr-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-runtime-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-sdk-5.0-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-targeting-pack-5.0-5.0.2-1.el7_9.x86_64.rpm
rh-dotnet50-dotnet-templates-5.0-5.0.102-1.el7_9.x86_64.rpm
rh-dotnet50-netstandard-targeting-pack-2.1-5.0.102-1.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-1723
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIUAwUBX/8ENtzjgjWX9erEAQjh5A/2IdPxRp4QSVH27LBp52uli+P8iYNYUQzJ
oSP0BhxXlPnwty70y6h3XF04F2AgWdqddLa07e/lQo/tZfD4x8a7N5qJzCd3AaHy
bhQaw5Rs2Yi/JM3l7nJbwL3kMnQ6+rg/w9IZG0JLPjEnURlcJmIArgIuNmWPBoxP
GRVhNlEohEwbQhgwwp0PJkIhX9MxvpVT0OPbcUV6TGox65X+b8kMuUfjRhuKdEge
l97WHuXTXa6QZMgaH28lSe8Vo6tkhzH89UEgo4CweybzptzPEgNfD4GOfpOrt9HG
iqiRhMnpVrfp+nqet1k+seBfjeTkMfZBmrGR8nsU69rCqG85gWvtuT5j5ba5PWRg
hHAg/bG4zIRlvRgIgTD00wVkGL0DC4zE/iI3bXZ7ATdl8pCADi1+uRyBwshbjbvL
jFo8RrHE4DCtM1+X0jJhPnED3tMQmNQkmYd/sUzj6dM1OfYUFu6CDnyqOo9wIPkD
yYTKp1/2lM8eJDtihM4vRRtfBUicagPAQ7Qu52VjDs9PwtSAReDE0FAnnfqfoRqt
FXwdqez+GIpc6JgVp+wgof9zY3mq+MKS3WKZwt+v7KUbsSrg0sQTYpuMI+JFjG9l
ZzAeU/ifax0HbO4R3rz2evVsT4yLGcSW7Yb/cTuPypLMFojFpSDzpkODfw3TGArj
allfL6TeAQ==
=fmd6
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX/+yuuNLKJtyKPYoAQhucA/+NyDQS6a5ASeaSQKzR0AwZIJv/1ZfktBf
/gfNAI7ad2IyOdtrIxfIl8yuij64PuI1w80xHejJL790HihUUjVz7pWPHUoVsv0M
1btVf9W4mrFCS1jiNyEAOmWjC1E39ms75DJQBFgnoAQe8yHHOW+NJXaJiZNwv/cr
OX9wIyzFAinKIp36Jj4+QQJl1PN9ZInEmKrBE2GN7Avecq6APDuAQpP/4Fps8u7F
41mn4+A2iMy1LX8RrEyaM80EJN4Po3/qLdgPl4N4qzA9/IIqZ3UfLJoAericKv86
aYRyoJU/ZX1hsJJRpw8xOe50v8JZH4UFYylMl/7W7tm7N6xNQ7R2XqH3029BfIr7
W0+gVpXSwOn3wPiKvinBBpxvCm/LVJqVA/z1c8nXH4K8TJggXUv01lKdXx7u7Ug1
dMdE3OOIZ5pp6HI7Tv0tBjO+PsucEVITFNd6MjUTiEnwRn3VIMkjF91MMmHlF86f
OTB/39Znl+2leBaXNH/o1ZIHbmQ+qf2dtI/JM5H+BM9mbvV2sUhWaTAhRBLGsWUr
6p04b4E/pNDHUVG7DAyRUtnAHv/e7BaddR4EduElDryp9myeNspmFeejol3UHURL
06aCydOp+WJFrTLBCIdoWVWiq+JXYYlT4Lc11bmMTC0EvpSE2ScoEbP5fKNA7UMN
HHKQ+ZMHC1Y=
=ecTS
-----END PGP SIGNATURE-----