{"id":"CVE-2021-41355","aliases":["ALSA-2021:3819","BIT-dotnet-2021-41355","BIT-dotnet-sdk-2021-41355","BIT-powershell-2021-41355","EUVD-2021-2183","GHSA-9cxh-gqpx-qc5m","RHSA-2021:3818","RHSA-2021:3819"],"status":"published","title":".NET Core and Visual Studio Information Disclosure Vulnerability","description":".NET Core and Visual Studio Information Disclosure Vulnerability","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.20342,"percentile":0.97497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2021-10-12T17:49:25Z","modified":"2026-10-29T11:00:46Z","fixes":[{"ecosystem":"NuGet","package":"System.DirectoryServices.Protocols","fixed_in":["5.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-5.0","fixed_in":["5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"aspnetcore-targeting-pack-5.0","fixed_in":["5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dotnet-apphost-pack-5.0","fixed_in":["5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dotnet-hostfxr-5.0","fixed_in":["5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dotnet-runtime-5.0","fixed_in":["5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dotnet-sdk-5.0","fixed_in":["5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dotnet-targeting-pack-5.0","fixed_in":["5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dotnet-templates-5.0","fixed_in":["5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["5.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["5.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"powershell","fixed_in":["7.1.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-runtime-5.0","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-targeting-pack-5.0","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet","fixed_in":["0:5.0.208-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-apphost-pack-5.0","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-debuginfo","fixed_in":["0:5.0.208-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-host","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-hostfxr-5.0","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-runtime-5.0","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-sdk-5.0","fixed_in":["0:5.0.208-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-sdk-5.0-source-built-artifacts","fixed_in":["0:5.0.208-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-targeting-pack-5.0","fixed_in":["0:5.0.11-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-templates-5.0","fixed_in":["0:5.0.208-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-netstandard-targeting-pack-2.1","fixed_in":["0:5.0.208-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-5.0","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-5.0","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0-debuginfo","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0-debuginfo","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0-debuginfo","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0-debuginfo","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-5.0","fixed_in":["0:5.0.11-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-5.0","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debuginfo","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debugsource","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netstandard-targeting-pack-2.1","fixed_in":["0:5.0.208-1.el8_4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"System.DirectoryServices.Protocols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspnetcore-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-apphost-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-hostfxr-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-sdk-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dotnet-templates-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"powershell","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0"},{"fixed":"7.1.5"}]}]},{"source":"osv","ecosystem":"NuGet","package":"System.DirectoryServices.Protocols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}],"versions":["4.5.0","4.5.0-preview1-25914-04","4.5.0-preview1-26216-02","4.5.0-preview2-26406-04","4.5.0-rc1","4.6.0","4.7.0","5.0.0"]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-aspnetcore-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-apphost-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-hostfxr-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-sdk-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-sdk-5.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-dotnet-templates-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:5.0::el7","package":"rh-dotnet50-netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.11-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet5.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.208-1.el8_4"}]}]}],"products":[{"vendor":"microsoft","product":".net"},{"vendor":"microsoft","product":".net 5.0"},{"vendor":"microsoft","product":"microsoft visual studio 2019 version 16.11 (includes 16.0 - 16.10)"},{"vendor":"microsoft","product":"microsoft visual studio 2019 version 16.9 (includes 16.0 - 16.8)"},{"vendor":"microsoft","product":"powershell"},{"vendor":"microsoft","product":"powershell 7.1"},{"vendor":"microsoft","product":"visual_studio_2019"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://github.com/dotnet/runtime/security/advisories/GHSA-9cxh-gqpx-qc5m","tags":["web"]},{"url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355","tags":["web"]},{"url":"https://github.com/dotnet/runtime/issues/60301","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41355","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9cxh-gqpx-qc5m"},{"url":"https://vulners.com/cve/CVE-2021-41355","tags":["report"]},{"url":"https://github.com/dotnet/runtime","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3818","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011487","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3818.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41355","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/203","tags":["article"]},{"url":"https://github.com/dotnet/core/blob/main/release-notes/5.0/5.0.11/5.0.11.md","tags":["article"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41355","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3819","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3819.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-41355","title":".NET Core and Visual Studio Information Disclosure Vulnerability","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2021-10-13T00:28:19Z","modified":"2024-08-04T03:08:32.217Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-2183","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2021-10-13T00:28:19Z","modified":"2024-08-04T03:08:32Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T03:24:18.226903Z"}],"ghsa":[{"id":"GHSA-9cxh-gqpx-qc5m","title":"Credential Disclosure in System.DirectoryServices.Protocols","description":"Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.\n\n### Patches\nAny .NET application that uses `System.DirectoryServices.Protocols` with a vulnerable version listed below on system based on Linux.\n\nPackage name | Vulnerable versions | Secure versions\n------------ | ---------------- | -------------------------\nSystem.DirectoryServices.Protocols | 5.0.0  | 5.0.1\n\n### Other Details\n\n- Announcement for this issue can be found at dotnet/announcements#202\n- An Issue for this can be found at https://github.com/dotnet/runtime/issues/60301\n- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355","status":"published","published":"2021-10-12T17:49:25Z","modified":"2023-02-01T05:06:13Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:38.281533Z"}],"nvd":[{"id":"CVE-2021-41355","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2021-10-13T01:15:13.907Z","modified":"2026-06-17T04:08:24.287Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":2.9,"vector":"AV:A/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:06:59.689345Z"}],"osv":[{"id":"CVE-2021-41355","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2021-10-13T01:15:13.907Z","modified":"2026-10-24T10:30:39.014776125Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"GHSA-9cxh-gqpx-qc5m","title":"Credential Disclosure in System.DirectoryServices.Protocols","description":"Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.\n\n### Patches\nAny .NET application that uses `System.DirectoryServices.Protocols` with a vulnerable version listed below on system based on Linux.\n\nPackage name | Vulnerable versions | Secure versions\n------------ | ---------------- | -------------------------\nSystem.DirectoryServices.Protocols | 5.0.0  | 5.0.1\n\n### Other Details\n\n- Announcement for this issue can be found at dotnet/announcements#202\n- An Issue for this can be found at https://github.com/dotnet/runtime/issues/60301\n- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355","status":"published","published":"2021-10-12T17:49:25Z","modified":"2025-09-04T18:27:02.873433Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"RHSA-2021:3818","title":"Red Hat Security Advisory: .NET 5.0 on RHEL 7 security and bugfix update","status":"published","published":"2024-09-16T06:36:07Z","modified":"2025-11-22T12:25:18Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3819","title":"Red Hat Security Advisory: .NET 5.0 security and bugfix update","status":"published","published":"2024-09-16T06:36:14Z","modified":"2025-11-22T12:25:18Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"ALSA-2021:3819","title":"Important: .NET 5.0 security and bugfix update","description":".NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.\n\nNew versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.208 and .NET Runtime 5.0.11.\n\nSecurity Fix(es):\n\n* dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails (CVE-2021-41355)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-10-12T19:35:54Z","modified":"2026-10-29T11:00:46.251648295Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-dotnet-2021-41355","title":".NET Core and Visual Studio Information Disclosure Vulnerability","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2024-03-06T10:59:07.911Z","modified":"2026-09-08T08:46:51.062610746Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2021-41355","title":".NET Core and Visual Studio Information Disclosure Vulnerability","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2024-03-06T10:59:15.535Z","modified":"2026-09-08T08:46:39.416807288Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-powershell-2021-41355","title":".NET Core and Visual Studio Information Disclosure Vulnerability","description":".NET Core and Visual Studio Information Disclosure Vulnerability","status":"published","published":"2025-09-04T17:48:36.166Z","modified":"2026-09-08T08:48:04.837346509Z","updated_at":"2026-11-02T15:28:34.724063Z"}]}}