.NET Core Information Disclosure Vulnerability

中 5.0CVE-2021-34485 · BIT-dotnet-2021-34485 · BIT-dotnet-sdk-2021-34485 · 12/08/2021 公開 · 07/10/2026 更新

要点

CVE-2021-34485 は Microsoft.NETCore.App, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 に影響する深刻度「中」 (CVSS 5.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.1%（全脆弱性の 81.4% より高い）。
対処：2.1.29, 5.0.9, 3.1.18, 7.0.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
Microsoft.NETCore.App NuGet	`≥ 2.1.0, < 2.1.29`	`2.1.29`
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.linux-arm NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.linux-arm64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.linux-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.Mono.osx-x64 NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.linux-arm NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.linux-musl-arm NuGet	`≥ 5.0.0, < 5.0.9`	`5.0.9`
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.linux-x64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.osx-x64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.rhel.6-x64 NuGet	`≥ 3.1.0, < 3.1.18`	`3.1.18`
Microsoft.NETCore.App.Runtime.win-arm NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.win-arm64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.win-x64 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
Microsoft.NETCore.App.Runtime.win-x86 NuGet	`≥ 3.1.0, < 3.1.18≥ 5.0.0, < 5.0.9`	`3.1.185.0.9`
.net microsoft	`≥ 5.0, ≤ 5.0.8`	修正版なし
.net core microsoft	`≥ 2.1, ≤ 2.1.28≥ 3.1, ≤ 3.1.17`	修正版なし
powershell core microsoft	`≥ 7.0, < 7.0.7≥ 7.1, < 7.1.4`	`7.0.77.1.4`
visual studio 2017 microsoft	`≥ 15.0, ≤ 15.9`	修正版なし
visual studio 2019 microsoft	`≥ 16.0, ≤ 16.10`	修正版なし

概要

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS.

Patches

If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.

Other Details

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/196
An Issue for this can be found at https://github.com/dotnet/runtime/issues/57174
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34485

NVD の説明

.NET Core and Visual Studio Information Disclosure Vulnerability

参考情報

dotnet/runtime security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-34485 · ADVISORY
dotnet/announcements · WEB
github/advisory-database · WEB
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485 · WEB
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34485

Microsoft.NETCore.App のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン