PT-2021-7948 · Microsoft+4 · System.Directoryservices.Protocols+4

Reno Robert · Published 2021-10-12 · Updated 2025-09-04 · CVE-2021-41355

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions System.DirectoryServices.Protocols version 5.0.0

Description A information disclosure issue exists where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux. This could allow a remote attacker to disclose protected information.

Recommendations For System.DirectoryServices.Protocols version 5.0.0, update to version 5.0.1 to resolve the issue. As a temporary workaround, consider restricting the use of System.DirectoryServices.Protocols on Linux systems until the update is applied. Avoid using the LdapConnection class in sensitive applications until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALSA-2021:3819

ALT-PU-2022-1269

ALT-PU-2022-1270

ALT-PU-2022-1272

ALT-PU-2022-1357

ALT-PU-2022-1358

ALT-PU-2022-1360

ALT-PU-2022-1544

ALT-PU-2022-1545

BDU:2023-06550

BIT-DOTNET-2021-41355

BIT-DOTNET-SDK-2021-41355

BIT-POWERSHELL-2021-41355

CESA-2021_3819

CVE-2021-41355

GHSA-9CXH-GQPX-QC5M

RHSA-2021:3818

RHSA-2021:3819

RHSA-2021_3819

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

System.Directoryservices.Protocols

References · 22

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-41355 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-3819.html · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41355 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41355 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-powershell-2021-41355 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2021-41355 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06550 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41355 · Security Note
• https://osv.dev/vulnerability/ALSA-2021:3819 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-2021-41355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41355 · Security Note
• https://osv.dev/vulnerability/GHSA-9cxh-gqpx-qc5m · Vendor Advisory
• https://github.com/dotnet/core/blob/main/release-notes/5.0/5.0.11/5.0.11.md · Note