{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Bot Framework SDK pour .NET Framework",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ASP.NET Core 3.1",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ASP.NET Core 5.0",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-1725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1725"
    },
    {
      "name": "CVE-2021-1723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1723"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-028",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft .Net\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de\nservice.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft .Net",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 janvier 2021",
      "url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.7 (includes 16.0 \u2013 16.6)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 8)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2012 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "HEVC Video Extensions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft System Center 2012 R2 Endpoint Protection",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2016 Service Pack 2 pour syst\u00e8mes x64 (CU 15)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft System Center Endpoint Protection",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Bot Framework SDK pour JavaScript",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Security Essentials",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Remote Desktop pour Android",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2015 Update 3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Azure Kubernetes Service",
      "product": {
        "name": "Azure",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2012 pour syst\u00e8mes x64 Service Pack 4 (QFE)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 22)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Bot Framework SDK pour Python",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Remote Desktop",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft System Center 2012 Endpoint Protection",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-1714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1714"
    },
    {
      "name": "CVE-2021-1725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1725"
    },
    {
      "name": "CVE-2021-1647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1647"
    },
    {
      "name": "CVE-2021-1680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1680"
    },
    {
      "name": "CVE-2021-1636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1636"
    },
    {
      "name": "CVE-2021-1651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1651"
    },
    {
      "name": "CVE-2021-1669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1669"
    },
    {
      "name": "CVE-2021-1643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1643"
    },
    {
      "name": "CVE-2021-1677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1677"
    },
    {
      "name": "CVE-2021-1715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1715"
    },
    {
      "name": "CVE-2020-26870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26870"
    },
    {
      "name": "CVE-2021-1644",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1644"
    },
    {
      "name": "CVE-2021-1711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1711"
    },
    {
      "name": "CVE-2021-1713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1713"
    },
    {
      "name": "CVE-2021-1716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1716"
    },
    {
      "name": "CVE-2021-1723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1723"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-029",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es,\nune usurpation d\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, un\ncontournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9, une \u00e9l\u00e9vation de\nprivil\u00e8ges et un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 janvier 2021",
      "url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Bot Framework SDK pour .NET Framework",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ASP.NET Core 3.1",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ASP.NET Core 5.0",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-1725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1725"
    },
    {
      "name": "CVE-2021-1723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1723"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-028",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft .Net\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de\nservice.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft .Net",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 janvier 2021",
      "url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.7 (includes 16.0 \u2013 16.6)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 8)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2012 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "HEVC Video Extensions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft System Center 2012 R2 Endpoint Protection",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2016 Service Pack 2 pour syst\u00e8mes x64 (CU 15)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft System Center Endpoint Protection",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Bot Framework SDK pour JavaScript",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Security Essentials",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Remote Desktop pour Android",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2015 Update 3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Azure Kubernetes Service",
      "product": {
        "name": "Azure",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2012 pour syst\u00e8mes x64 Service Pack 4 (QFE)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 22)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Bot Framework SDK pour Python",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Remote Desktop",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft System Center 2012 Endpoint Protection",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-1714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1714"
    },
    {
      "name": "CVE-2021-1725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1725"
    },
    {
      "name": "CVE-2021-1647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1647"
    },
    {
      "name": "CVE-2021-1680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1680"
    },
    {
      "name": "CVE-2021-1636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1636"
    },
    {
      "name": "CVE-2021-1651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1651"
    },
    {
      "name": "CVE-2021-1669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1669"
    },
    {
      "name": "CVE-2021-1643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1643"
    },
    {
      "name": "CVE-2021-1677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1677"
    },
    {
      "name": "CVE-2021-1715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1715"
    },
    {
      "name": "CVE-2020-26870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26870"
    },
    {
      "name": "CVE-2021-1644",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1644"
    },
    {
      "name": "CVE-2021-1711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1711"
    },
    {
      "name": "CVE-2021-1713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1713"
    },
    {
      "name": "CVE-2021-1716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1716"
    },
    {
      "name": "CVE-2021-1723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1723"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-029",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es,\nune usurpation d\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, un\ncontournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9, une \u00e9l\u00e9vation de\nprivil\u00e8ges et un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 janvier 2021",
      "url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
    }
  ]
}

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "TO708, TO711, TO712, TO713, TO716",
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": "TO708 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Visual Studio 2019 16.11.30, TO711 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Visual Studio 2019 16.4.27, TO712 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Visual Studio 2019 16.7.27, TO713 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Visual Studio 2019 16.8.7, TO716 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Visual Studio 2019 16.11.21",
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "3.1 (ASP.NET Core), \u043e\u0442 16.0 \u0434\u043e 16.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Microsoft Visual Studio 2019), \u043e\u0442 16.0 \u0434\u043e 16.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Microsoft Visual Studio 2019), 16.8 (Microsoft Visual Studio 2019), 5.0 (ASP.NET Core)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1723",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.01.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.01.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.01.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-00192",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-1723",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "ASP.NET Core, Microsoft Visual Studio 2019",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b ASP.NET Core \u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Microsoft Visual Studio, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b ASP.NET Core \u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Microsoft Visual Studio \u0441\u0432\u044f\u0437\u0430\u043df \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1723",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C21F09B3-A69F-43B9-B35E-EBF93314F31E",
              "versionEndIncluding": "3.1.10",
              "versionStartIncluding": "3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C91649F-55B9-4675-BA0F-2B876A73D9A4",
              "versionEndIncluding": "5.0.1",
              "versionStartIncluding": "5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD824DE6-3564-4B7D-B45C-2EEE1F84C9D2",
              "versionEndIncluding": "16.8",
              "versionStartIncluding": "16.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ASP.NET Core and Visual Studio Denial of Service Vulnerability"
    },
    {
      "lang": "es",
      "value": "Una Vulnerabilidad de Denegaci\u00f3n de Servicio de ASP.NET Core y Visual Studio"
    }
  ],
  "id": "CVE-2021-1723",
  "lastModified": "2024-11-21T05:44:58.590",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-01-12T20:15:34.993",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1723"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.Server.Kestrel.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.1"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-1723"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-24T20:26:09Z",
    "nvd_published_at": "2021-01-12T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.",
  "id": "GHSA-242j-2gm6-5rwx",
  "modified": "2024-10-09T18:33:50Z",
  "published": "2022-05-24T17:38:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1723"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/170"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1723"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ASP.NET Core and Visual Studio Denial of Service Vulnerability"
}

{
  "GSD": {
    "alias": "CVE-2021-1723",
    "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
    "id": "GSD-2021-1723",
    "references": [
      "https://access.redhat.com/errata/RHSA-2021:0114",
      "https://access.redhat.com/errata/RHSA-2021:0096",
      "https://access.redhat.com/errata/RHSA-2021:0095",
      "https://access.redhat.com/errata/RHSA-2021:0094",
      "https://security.archlinux.org/CVE-2021-1723",
      "https://linux.oracle.com/cve/CVE-2021-1723.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-1723"
      ],
      "details": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
      "id": "GSD-2021-1723",
      "modified": "2023-12-13T01:23:22.885223Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2021-1723",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ASP.NET Core 3.1",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "3.0",
                          "version_value": "publication"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ASP.NET Core 5.0",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "5.0",
                          "version_value": "publication"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "16.0",
                          "version_value": "publication"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Visual Studio 2019 version 16.8",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "16.0",
                          "version_value": "publication"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Visual Studio 2019 version 16.7 (includes 16.0 \u2013 16.6)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "16.0.0",
                          "version_value": "publication"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ASP.NET Core and Visual Studio Denial of Service Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Denial of Service"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "refsource": "MISC",
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[3.1,3.1.10],[5.0,5.0.1]",
          "affected_versions": "All versions starting from 3.1 up to 3.1.10, all versions starting from 5.0 up to 5.0.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-07-08",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1, all versions after 3.1.10 before 5.0, all versions after 5.0.1",
          "package_slug": "nuget/Microsoft.AspNetCore.All",
          "pubdate": "2021-01-12",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723"
          ],
          "uuid": "85bcae0d-669d-49a7-9df7-2e2e2afcec05"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-arm",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "a36dedf9-b28b-45ca-95b5-70c24f63db45"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "39cd82ce-1140-4a8a-8800-d404f8ca691b"
        },
        {
          "affected_range": "[5.0.1]",
          "affected_versions": "Version 5.0.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-11-03",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 5.0.1, all versions after 5.0.1",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to version 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "9b539222-7847-46bd-b18b-33374f149a89"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "45d660c0-0a3b-40a4-97d2-45292aabca3d"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "49bb246e-a448-4c9f-a951-25dc685b9e52"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.linux-x64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "3cba4e6f-3191-46a5-8dd0-d30848f30572"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.osx-x64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "301fb990-1cb6-4786-8ef1-db3270dc02bc"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-arm",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "50d4a1c9-1040-4f5c-87fd-9cef8ce53575"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-arm64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "ec9bd81e-4298-414a-a817-ba176c9df9b0"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-x64",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "907541a6-0a8b-421f-8b52-b1d2770e8b98"
        },
        {
          "affected_range": "[3.1.0,3.1.11),[5.0.0,5.0.2)",
          "affected_versions": "All versions starting from 3.1.0 before 3.1.11, all versions starting from 5.0.0 before 5.0.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "3.1.11",
            "5.0.2"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions before 3.1.0, all versions starting from 3.1.11 before 5.0.0, all versions starting from 5.0.2",
          "package_slug": "nuget/Microsoft.AspNetCore.App.Runtime.win-x86",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 3.1.11, 5.0.2 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "f1f238d7-a542-4dc0-83cb-7d7b688461c7"
        },
        {
          "affected_range": "(,2.1.25)",
          "affected_versions": "All versions before 2.1.25",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-26",
          "description": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "fixed_versions": [
            "2.1.25"
          ],
          "identifier": "CVE-2021-1723",
          "identifiers": [
            "GHSA-242j-2gm6-5rwx",
            "CVE-2021-1723"
          ],
          "not_impacted": "All versions starting from 2.1.25",
          "package_slug": "nuget/Microsoft.AspNetCore.Server.Kestrel.Core",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to version 2.1.25 or above.",
          "title": "ASP.NET Core and Visual Studio Denial of Service Vulnerability",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L27CGRVEWUPELNJOGTCW6GLEDBECB4B/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRXHERXW4KR5WCP76UDW5PC7GX3YQLUW/",
            "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723",
            "https://github.com/dotnet/announcements/issues/170",
            "https://github.com/advisories/GHSA-242j-2gm6-5rwx"
          ],
          "uuid": "b84c8566-f86b-4a58-aaf8-a798160bc624"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C21F09B3-A69F-43B9-B35E-EBF93314F31E",
                    "versionEndIncluding": "3.1.10",
                    "versionStartIncluding": "3.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7C91649F-55B9-4675-BA0F-2B876A73D9A4",
                    "versionEndIncluding": "5.0.1",
                    "versionStartIncluding": "5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FD824DE6-3564-4B7D-B45C-2EEE1F84C9D2",
                    "versionEndIncluding": "16.8",
                    "versionStartIncluding": "16.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "ASP.NET Core and Visual Studio Denial of Service Vulnerability"
          },
          {
            "lang": "es",
            "value": "Una Vulnerabilidad de Denegaci\u00f3n de Servicio de ASP.NET Core y Visual Studio"
          }
        ],
        "id": "CVE-2021-1723",
        "lastModified": "2023-12-29T17:15:53.777",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "secure@microsoft.com",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-01-12T20:15:34.993",
        "references": [
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1723"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for .NET 5.0 is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": ".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.102 and .NET Runtime 5.0.2.\n\nSecurity Fix(es):\n\n* dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2 (CVE-2021-1723)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:0094",
        "url": "https://access.redhat.com/errata/RHSA-2021:0094"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1914258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914258"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0094.json"
      }
    ],
    "title": "Red Hat Security Advisory: dotnet5.0 security and bugfix update",
    "tracking": {
      "current_release_date": "2025-11-21T18:19:39+00:00",
      "generator": {
        "date": "2025-11-21T18:19:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2021:0094",
      "initial_release_date": "2021-01-13T15:03:10+00:00",
      "revision_history": [
        {
          "date": "2021-01-13T15:03:10+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-01-13T15:03:10+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T18:19:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.3.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/aspnetcore-runtime-5.0@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/aspnetcore-targeting-pack-5.0@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "dotnet-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-apphost-pack-5.0@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-host-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-host-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-host-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-host@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-hostfxr-5.0@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-runtime-5.0@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-sdk-5.0@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-targeting-pack-5.0@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-templates-5.0@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/netstandard-targeting-pack-2.1@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet5.0-debugsource@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-apphost-pack-5.0-debuginfo@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-host-debuginfo@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-hostfxr-5.0-debuginfo@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_id": "dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-runtime-5.0-debuginfo@5.0.2-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-sdk-5.0-debuginfo@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
                "product": {
                  "name": "dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
                  "product_id": "dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet5.0-debuginfo@5.0.102-2.el8_3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dotnet5.0-0:5.0.102-2.el8_3.src",
                "product": {
                  "name": "dotnet5.0-0:5.0.102-2.el8_3.src",
                  "product_id": "dotnet5.0-0:5.0.102-2.el8_3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet5.0@5.0.102-2.el8_3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-host-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-host-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-host-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet5.0-0:5.0.102-2.el8_3.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet5.0-0:5.0.102-2.el8_3.src"
        },
        "product_reference": "dotnet5.0-0:5.0.102-2.el8_3.src",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64"
        },
        "product_reference": "netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-1723",
      "cwe": {
        "id": "CWE-833",
        "name": "Deadlock"
      },
      "discovery_date": "2021-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1914258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dotnet. Running callbacks outside of locks results in Krestel deadlock using HTTP2. The highest threat from this vulnerability is to system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-0:5.0.102-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-host-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet5.0-0:5.0.102-2.el8_3.src",
          "AppStream-8.3.0.Z.MAIN:dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-1723"
        },
        {
          "category": "external",
          "summary": "RHBZ#1914258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-1723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-1723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1723"
        },
        {
          "category": "external",
          "summary": "https://github.com/dotnet/announcements/issues/170",
          "url": "https://github.com/dotnet/announcements/issues/170"
        },
        {
          "category": "external",
          "summary": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723",
          "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723"
        }
      ],
      "release_date": "2021-01-12T17:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-01-13T15:03:10+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-host-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet5.0-0:5.0.102-2.el8_3.src",
            "AppStream-8.3.0.Z.MAIN:dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:0094"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-host-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-host-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-5.0-debuginfo-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-5.0-0:5.0.2-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-templates-5.0-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet5.0-0:5.0.102-2.el8_3.src",
            "AppStream-8.3.0.Z.MAIN:dotnet5.0-debuginfo-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet5.0-debugsource-0:5.0.102-2.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:netstandard-targeting-pack-2.1-0:5.0.102-2.el8_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": ".NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET Core that address a security vulnerability are now available. The updated versions are .NET Core SDK 3.1.111 and .NET Core Runtime 3.1.11.\n\nSecurity Fix(es):\n\n* dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2 (CVE-2021-1723)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:0095",
        "url": "https://access.redhat.com/errata/RHSA-2021:0095"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1914258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914258"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0095.json"
      }
    ],
    "title": "Red Hat Security Advisory: dotnet3.1 security and bugfix update",
    "tracking": {
      "current_release_date": "2025-11-21T18:19:40+00:00",
      "generator": {
        "date": "2025-11-21T18:19:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2021:0095",
      "initial_release_date": "2021-01-13T15:02:57+00:00",
      "revision_history": [
        {
          "date": "2021-01-13T15:02:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-01-13T15:02:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T18:19:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.3.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/aspnetcore-runtime-3.1@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/aspnetcore-targeting-pack-3.1@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-apphost-pack-3.1@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-hostfxr-3.1@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-runtime-3.1@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
                  "product_id": "dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-sdk-3.1@3.1.111-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-targeting-pack-3.1@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
                  "product_id": "dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-templates-3.1@3.1.111-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64",
                  "product_id": "dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet3.1-debugsource@3.1.111-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-apphost-pack-3.1-debuginfo@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-hostfxr-3.1-debuginfo@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                  "product_id": "dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-runtime-3.1-debuginfo@3.1.11-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
                  "product_id": "dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet-sdk-3.1-debuginfo@3.1.111-1.el8_3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
                "product": {
                  "name": "dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
                  "product_id": "dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet3.1-debuginfo@3.1.111-1.el8_3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dotnet3.1-0:3.1.111-1.el8_3.src",
                "product": {
                  "name": "dotnet3.1-0:3.1.111-1.el8_3.src",
                  "product_id": "dotnet3.1-0:3.1.111-1.el8_3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet3.1@3.1.111-1.el8_3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64"
        },
        "product_reference": "dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet3.1-0:3.1.111-1.el8_3.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet3.1-0:3.1.111-1.el8_3.src"
        },
        "product_reference": "dotnet3.1-0:3.1.111-1.el8_3.src",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64"
        },
        "product_reference": "dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.3.0.Z.MAIN:dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64"
        },
        "product_reference": "dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64",
        "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-1723",
      "cwe": {
        "id": "CWE-833",
        "name": "Deadlock"
      },
      "discovery_date": "2021-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1914258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dotnet. Running callbacks outside of locks results in Krestel deadlock using HTTP2. The highest threat from this vulnerability is to system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet3.1-0:3.1.111-1.el8_3.src",
          "AppStream-8.3.0.Z.MAIN:dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
          "AppStream-8.3.0.Z.MAIN:dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-1723"
        },
        {
          "category": "external",
          "summary": "RHBZ#1914258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-1723",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-1723"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-1723",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1723"
        },
        {
          "category": "external",
          "summary": "https://github.com/dotnet/announcements/issues/170",
          "url": "https://github.com/dotnet/announcements/issues/170"
        },
        {
          "category": "external",
          "summary": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723",
          "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723"
        }
      ],
      "release_date": "2021-01-12T17:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-01-13T15:02:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet3.1-0:3.1.111-1.el8_3.src",
            "AppStream-8.3.0.Z.MAIN:dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:0095"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.3.0.Z.MAIN:aspnetcore-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:aspnetcore-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-apphost-pack-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-hostfxr-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-runtime-3.1-debuginfo-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-sdk-3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-targeting-pack-3.1-0:3.1.11-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet-templates-3.1-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet3.1-0:3.1.111-1.el8_3.src",
            "AppStream-8.3.0.Z.MAIN:dotnet3.1-debuginfo-0:3.1.111-1.el8_3.x86_64",
            "AppStream-8.3.0.Z.MAIN:dotnet3.1-debugsource-0:3.1.111-1.el8_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2"
    }
  ]
}