crítica
CVE-2021-26701
dotnet: System.Text.Encodings.Web Remote Code Execution
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Bitnami, Photon OS. Más baja según Red Hat (alta), Oracle (alta).
Descripción
.NET Core Remote Code Execution Vulnerability
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet, dotnet-sdk | 5.0.4 |
| nuget::GitHub Security Advisory NuGet | System.Text.Encodings.Web, system.text.encodings.web | 4.5.1, 4.7.2, 5.0.1 |
| Photon OS 4.0 | dotnet-sdk | 6.0.428-1.ph4 |
| Oracle Linux 8 | aspnetcore-runtime-3.1, aspnetcore-runtime-5.0, aspnetcore-targeting-pack-3.1 y 20 más | 3.1.13-1.0.1.el8_3 y 5 más |
Mostrar las 28 entradas de 4 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | dotnet | 5.0.4 |
| bitnami::Bitnami Vulnerability Database | dotnet-sdk | 5.0.4 |
| nuget::GitHub Security Advisory NuGet | System.Text.Encodings.Web | 4.5.1, 4.7.2, 5.0.1 |
| nuget::GitHub Security Advisory NuGet | system.text.encodings.web | 4.5.1, 4.7.2, 5.0.1 |
| Photon OS 4.0 | dotnet-sdk | 6.0.428-1.ph4 |
| Oracle Linux 8 | aspnetcore-runtime-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | aspnetcore-runtime-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | aspnetcore-targeting-pack-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | aspnetcore-targeting-pack-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet | 5.0.104-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-apphost-pack-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-apphost-pack-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-host | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-host-fxr-2.1 | 2.1.26-1.el8_3 |
| Oracle Linux 8 | dotnet-hostfxr-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-hostfxr-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-runtime-2.1 | 2.1.26-1.el8_3 |
| Oracle Linux 8 | dotnet-runtime-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-runtime-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-2.1 | 2.1.522-1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-2.1.5xx | 2.1.522-1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-3.1 | 3.1.113-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-sdk-5.0 | 5.0.104-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-targeting-pack-3.1 | 3.1.13-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-targeting-pack-5.0 | 5.0.4-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-templates-3.1 | 3.1.113-1.0.1.el8_3 |
| Oracle Linux 8 | dotnet-templates-5.0 | 5.0.104-1.0.1.el8_3 |
| Oracle Linux 8 | netstandard-targeting-pack-2.1 | 5.0.104-1.0.1.el8_3 |
Referencias
- https://access.redhat.com/security/cve/CVE-2021-26701
- https://github.com/dotnet/announcements/issues/178
- https://linux.oracle.com/cve/CVE-2021-26701.html
- https://linux.oracle.com/errata/ELSA-2021-0793.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S2AZOUKMCHT2WBHR7MYDTYXWOBHZW5P5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW3ZSJTTMZAFKGW7NJWTVVFZUYYU2SJZ/
Las 20 referencias
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBOSSX7U6BSHV5RI74FCOW4ITJ5RRJR5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA5WQJVHUL5C4XMJTLY3C67R4WP35EF4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPUKFHIGP5YNJRRFWKDJ2XRS4WTFJNNK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLFATXASXW4OV2ZBSRP4G55HJH73QPBP/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26701
- https://nvd.nist.gov/vuln/detail/CVE-2021-26701
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701
- https://www.cve.org/CVERecord?id=CVE-2021-26701