PT-2021-7948

CVE-2021-41355

·

Published

2021-10-12

·

Updated

2025-09-04

Description by

CVSS 2.0
6.1
Medium
MetricsAV:A/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions System.DirectoryServices.Protocols version 5.0.0
Description A information disclosure issue exists where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux. This could allow a remote attacker to disclose protected information.
Recommendations For System.DirectoryServices.Protocols version 5.0.0, update to version 5.0.1 to resolve the issue. As a temporary workaround, consider restricting the use of System.DirectoryServices.Protocols on Linux systems until the update is applied. Avoid using the LdapConnection class in sensitive applications until the issue is resolved.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2021-41355
BDU:2023-06550
GHSA-9CXH-GQPX-QC5M
ALSA-2021:3819
ALT-PU-2022-1269
ALT-PU-2022-1270
ALT-PU-2022-1272
ALT-PU-2022-1357
ALT-PU-2022-1358
ALT-PU-2022-1360
ALT-PU-2022-1544
ALT-PU-2022-1545
BIT-DOTNET-2021-41355
BIT-DOTNET-SDK-2021-41355
BIT-POWERSHELL-2021-41355
CESA-2021_3819
RHSA-2021:3818
RHSA-2021:3819
RHSA-2021_3819
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com