CVE-2021-34532
Fixed in a distro release EPSS 1%CVSS 5.5
ASP.NET Core and Visual Studio Information Disclosure Vulnerability
Products: Microsoft ASP.NET Core 2.1, Microsoft ASP.NET Core 3.1, Microsoft ASP.NET Core 5.0, Microsoft Visual Studio 2019 version 16.10 (includes 16.0 - 16.9), Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3), Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6), Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8), Microsoft Visual Studio 2019 for Mac version 8.10
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.AspNetCore.Authentication.JwtBearer | 2.1.29 |
| NuGet | Microsoft.AspNetCore.Authentication.JwtBearer | 3.1.18 |
| NuGet | Microsoft.AspNetCore.Authentication.JwtBearer | 5.0.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | dotnet-runtime | 6.0.0.sdk100-1 |
| Arch Linux | dotnet-sdk | 6.0.0.sdk100-1 |
| Red Hat Enterprise Linux 8 | aspnetcore-runtime-3.1 | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | aspnetcore-runtime-5.0 | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | aspnetcore-targeting-pack-3.1 | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | aspnetcore-targeting-pack-5.0 | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-3.1 | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-3.1-debuginfo | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-5.0 | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-apphost-pack-5.0-debuginfo | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-host | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-host-debuginfo | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-3.1 | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-3.1-debuginfo | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-5.0 | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-hostfxr-5.0-debuginfo | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-3.1 | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-3.1-debuginfo | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-5.0 | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-runtime-5.0-debuginfo | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-3.1 | 0:3.1.118-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-3.1-debuginfo | 0:3.1.118-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-5.0 | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-sdk-5.0-debuginfo | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-targeting-pack-3.1 | 0:3.1.18-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-targeting-pack-5.0 | 0:5.0.9-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-templates-3.1 | 0:3.1.118-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet-templates-5.0 | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet3.1 | 0:3.1.118-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet3.1-debuginfo | 0:3.1.118-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet3.1-debugsource | 0:3.1.118-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet5.0 | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet5.0-debuginfo | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | dotnet5.0-debugsource | 0:5.0.206-1.el8_4 |
| Red Hat Enterprise Linux 8 | netstandard-targeting-pack-2.1 | 0:5.0.206-1.el8_4 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-aspnetcore-runtime-3.1 | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-aspnetcore-targeting-pack-3.1 | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet | 0:3.1.118-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-apphost-pack-3.1 | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-debuginfo | 0:3.1.118-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-host | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-hostfxr-3.1 | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-runtime-3.1 | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-sdk-3.1 | 0:3.1.118-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-targeting-pack-3.1 | 0:3.1.18-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-dotnet-templates-3.1 | 0:3.1.118-1.el7_9 |
| Red Hat rhel dotnet 3.1 | rh-dotnet31-netstandard-targeting-pack-2.1 | 0:3.1.118-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-aspnetcore-runtime-5.0 | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-aspnetcore-targeting-pack-5.0 | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet | 0:5.0.206-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-apphost-pack-5.0 | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-debuginfo | 0:5.0.206-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-host | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-hostfxr-5.0 | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-runtime-5.0 | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-sdk-5.0 | 0:5.0.206-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-targeting-pack-5.0 | 0:5.0.9-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-dotnet-templates-5.0 | 0:5.0.206-1.el7_9 |
| Red Hat rhel dotnet 5.0 | rh-dotnet50-netstandard-targeting-pack-2.1 | 0:5.0.206-1.el7_9 |