Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KaitaiStruct.Runtime.CSharp v0.10.0 contains indirect vulnerable references #20

Open
Kielek opened this issue Sep 10, 2024 · 0 comments · May be fixed by #21
Open

KaitaiStruct.Runtime.CSharp v0.10.0 contains indirect vulnerable references #20

Kielek opened this issue Sep 10, 2024 · 0 comments · May be fixed by #21

Comments

@Kielek
Copy link

Kielek commented Sep 10, 2024

.NET9 will bring extended audit for vulnerable references including all indirect references.
It can be replicated also on older versions by compiling projects with following options

    <NuGetAudit>true</NuGetAudit>
    <NuGetAuditMode>all</NuGetAuditMode>
    <NuGetAuditLevel>low</NuGetAuditLevel>

Preparing OTel contrib repository for this, reveals that KaitaiStruct.Runtime.CSharp v0.10.0 brings

The issue is valid for all available targets netstandard1.3 and net4.5.

Fix
Drop support both for netstandard1.3 and net4.5. Replace it by net6.0 and net462. It should cover all supported .NET versions. If needed, it can be extended also by netstandard2.0.
Next step is release never version.

Workaround
Manually pin packages to non-vulnerable version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant