Skip to content

Commit be36699

Browse files
MichaelSimonsMichaelSimons
authored
Update vulnerable package references (#1118)
* Update vulnerable package references * Update the readme
1 parent 43f2c55 commit be36699

File tree

49 files changed

+210
-14512
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+210
-14512
lines changed

‎README.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,19 @@ a new targeting pack is needed, please [open a new issue](#filing-issues) to dis
9999
## Vulnerable Packages
100100

101101
CVEs may exist for reference packages included in this repo. If they are mitigated by a newer version, the
102-
newer version should be added, the vulnerable version should be removed, and references to the vulnerable
103-
package within other reference packages should be upgraded. A comment should be added to indicate when
104-
packages were manually upgraded.
102+
newer version should be added, the vulnerable version should be removed (only if there are no product repo
103+
references to it), and references to the vulnerable package within other reference packages should be upgraded.
104+
A comment should be added to indicate when packages were manually upgraded in both the csproj and nuspec files.
105105

106106
``` xml
107-
<!-- Manually updated version from 4.3.0 to address CVE-2017-0247 -->
107+
<!-- Manual upgrade from 4.3.0 to address CVE-2017-0247 -->
108108
<PackageReference Include="System.Net.Security" Version="4.3.1" />
109109
```
110110

111+
All packages that contain a manually upgraded reference must be added to the eng/build.props as a
112+
DependencyPackageProjects in order to prevent the n-1 version from getting loaded which would still
113+
reference the vulnerable version.
114+
111115
## Filing Issues
112116

113117
This repo does not accept issues. Please file issues in

‎eng/Build.props

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,22 @@
2222
Format:
2323
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Extensions.Options.5.0.0.csproj" />
2424
-->
25+
26+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Text.Json.6.0.10.csproj" />
27+
28+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Extensions.DependencyModel.6.0.10.csproj" />
29+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Cng.5.0.0.csproj" />
30+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Pkcs.6.0.4.csproj" />
31+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Pkcs.7.0.2.csproj" />
32+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Pkcs.8.0.0.csproj" />
33+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Xml.6.0.1.csproj" />
34+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Xml.7.0.1.csproj" />
35+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Build.17.3.4.csproj" />
36+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Build.Tasks.Core.17.4.0.csproj" />
37+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\NuGet.Protocol.6.8.1.csproj" />
38+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\NuGet.Protocol.6.11.0.csproj" />
39+
<DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\NuGet.Protocol.6.12.1.csproj" />
40+
2541
</ItemGroup>
2642

2743
<ItemGroup Condition="'$(BuildDependencyPackageProjects)' == 'true'">
@@ -40,6 +56,21 @@
4056
<Copy Condition="'$(LocalNuGetPackageCacheDirectory)' != ''"
4157
SourceFiles="@(DependencyPackageProjects->'$(ArtifactsShippingPackagesDir)%(FileName).nupkg')"
4258
DestinationFolder="$(LocalNuGetPackageCacheDirectory)" />
59+
60+
<!--
61+
When building in the VMR, any dependencyPackageProjects that existing in the ReferencePackagesDir
62+
must be cleaned up. This can happen when manually updating packages to address vulnerable references.
63+
In this case the ReferencePackagesDir contains the unpatched versions. This will note be needed when
64+
the need for DependencyPackageProjects is removed as part of https://github.com/dotnet/source-build/issues/1690.
65+
-->
66+
<ItemGroup>
67+
<FilesToDelete Condition="'$(VmrReferencePackagesDir)' != ''"
68+
Include="@(DependencyPackageProjects->'$(VmrReferencePackagesDir)%(FileName).nupkg')"/>
69+
</ItemGroup>
70+
<Message Condition="'$(VmrReferencePackagesDir)' != ''"
71+
Text="Deleting Files @(FilesToDelete)" />
72+
<Delete Condition="'$(VmrReferencePackagesDir)' != ''"
73+
Files="@(FilesToDelete)" />
4374
</Target>
4475

4576
<ItemGroup Condition="'$(GeneratePackageSource)' != 'true' and '$(BuildDependencyPackageProjects)' != 'true' and '$(Test)' != 'true'">

‎eng/DotNetBuild.props

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
and because this target executes before Execute, the build will infinitely recurse. This probably could be fixed in other ways, but
2727
given that SBRP is slated at some point to get proper support for project refs as a replacement for this invocation, this isn't really worth doing. -->
2828
<Exec
29-
Command="./build.sh --configuration $(Configuration) /bl:$(ArtifactsDir)sourcebuild-dependency-projects.binlog /p:LocalNuGetPackageCacheDirectory=$(LocalNuGetPackageCacheDirectory) /p:SourceBuildOutputDir=$(SourceBuildOutputDir) /p:BuildDependencyPackageProjects=true /p:SetUpSourceBuildIntermediateNupkgCache=true /p:DotNetBuildOrchestrator=$(DotNetBuildOrchestrator) /p:DotNetBuildSourceOnly=true /p:DotNetBuildInnerRepo=true /p:MicrosoftNetCoreIlasmPackageRuntimeId=$(MicrosoftNetCoreIlasmPackageRuntimeId) $(_AdditionalDependencyProjectsBuildArgs)"
29+
Command="./build.sh --configuration $(Configuration) /bl:$(ArtifactsDir)sourcebuild-dependency-projects.binlog /p:LocalNuGetPackageCacheDirectory=$(LocalNuGetPackageCacheDirectory) /p:VmrReferencePackagesDir=$(VmrReferencePackagesDir) /p:SourceBuildOutputDir=$(SourceBuildOutputDir) /p:BuildDependencyPackageProjects=true /p:SetUpSourceBuildIntermediateNupkgCache=true /p:DotNetBuildOrchestrator=$(DotNetBuildOrchestrator) /p:DotNetBuildSourceOnly=true /p:DotNetBuildInnerRepo=true /p:MicrosoftNetCoreIlasmPackageRuntimeId=$(MicrosoftNetCoreIlasmPackageRuntimeId) $(_AdditionalDependencyProjectsBuildArgs)"
3030
WorkingDirectory="$(InnerSourceBuildRepoRoot)"
3131
EnvironmentVariables="@(InnerBuildEnv)" />
3232
</Target>

‎src/referencePackages/src/microsoft.build.tasks.core/17.4.0/Microsoft.Build.Tasks.Core.17.4.0.csproj

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@
1313
<PackageReference Include="System.Collections.Immutable" Version="6.0.0" />
1414
<PackageReference Include="System.Reflection.Metadata" Version="6.0.0" />
1515
<PackageReference Include="System.Resources.Extensions" Version="6.0.0" />
16-
<PackageReference Include="System.Security.Cryptography.Pkcs" Version="6.0.1" />
17-
<!-- Manually updated version from 6.0.0 to address CVE-2021-43877 -->
16+
<!-- Manual upgrade from 6.0.1 to address CVE-2023-29331 -->
17+
<PackageReference Include="System.Security.Cryptography.Pkcs" Version="6.0.4" />
18+
<!-- Manual upgrade from 6.0.0 to address CVE-2021-43877 -->
1819
<PackageReference Include="System.Security.Cryptography.Xml" Version="6.0.1" />
1920
<PackageReference Include="System.Security.Permissions" Version="6.0.0" />
2021
<PackageReference Include="System.Threading.Tasks.Dataflow" Version="6.0.0" />
@@ -29,8 +30,9 @@
2930
<PackageReference Include="System.Collections.Immutable" Version="6.0.0" />
3031
<PackageReference Include="System.Reflection.Metadata" Version="6.0.0" />
3132
<PackageReference Include="System.Resources.Extensions" Version="6.0.0" />
32-
<PackageReference Include="System.Security.Cryptography.Pkcs" Version="6.0.1" />
33-
<!-- Manually updated version from 6.0.0 to address CVE-2021-43877 -->
33+
<!-- Manual upgrade from 6.0.1 to address CVE-2023-29331 -->
34+
<PackageReference Include="System.Security.Cryptography.Pkcs" Version="6.0.4" />
35+
<!-- Manual upgrade from 6.0.0 to address CVE-2021-43877 -->
3436
<PackageReference Include="System.Security.Cryptography.Xml" Version="6.0.1" />
3537
<PackageReference Include="System.Security.Permissions" Version="6.0.0" />
3638
<PackageReference Include="System.Threading.Tasks.Dataflow" Version="6.0.0" />

‎src/referencePackages/src/microsoft.build.tasks.core/17.4.0/microsoft.build.tasks.core.nuspec

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@
2323
<dependency id="System.Collections.Immutable" version="6.0.0" exclude="Build,Analyzers" />
2424
<dependency id="System.Reflection.Metadata" version="6.0.0" exclude="Build,Analyzers" />
2525
<dependency id="System.Resources.Extensions" version="6.0.0" exclude="Build,Analyzers" />
26-
<dependency id="System.Security.Cryptography.Pkcs" version="6.0.1" exclude="Build,Analyzers" />
26+
<!-- Manual upgrade from 6.0.1 to address CVE-2023-29331 -->
27+
<dependency id="System.Security.Cryptography.Pkcs" version="6.0.4" exclude="Build,Analyzers" />
2728
<dependency id="System.Security.Cryptography.Xml" version="6.0.1" exclude="Build,Analyzers" />
2829
<dependency id="System.Security.Permissions" version="6.0.0" exclude="Build,Analyzers" />
2930
<dependency id="System.Threading.Tasks.Dataflow" version="6.0.0" exclude="Build,Analyzers" />
@@ -37,7 +38,8 @@
3738
<dependency id="System.Collections.Immutable" version="6.0.0" exclude="Build,Analyzers" />
3839
<dependency id="System.Reflection.Metadata" version="6.0.0" exclude="Build,Analyzers" />
3940
<dependency id="System.Resources.Extensions" version="6.0.0" exclude="Build,Analyzers" />
40-
<dependency id="System.Security.Cryptography.Pkcs" version="6.0.1" exclude="Build,Analyzers" />
41+
<!-- Manual upgrade from 6.0.1 to address CVE-2023-29331 -->
42+
<dependency id="System.Security.Cryptography.Pkcs" version="6.0.4" exclude="Build,Analyzers" />
4143
<dependency id="System.Security.Cryptography.Xml" version="6.0.1" exclude="Build,Analyzers" />
4244
<dependency id="System.Security.Permissions" version="6.0.0" exclude="Build,Analyzers" />
4345
<dependency id="System.Threading.Tasks.Dataflow" version="6.0.0" exclude="Build,Analyzers" />

‎src/referencePackages/src/microsoft.build/17.3.4/Microsoft.Build.17.3.4.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
<PackageReference Include="System.Reflection.MetadataLoadContext" Version="6.0.0" />
1515
<PackageReference Include="System.Security.Principal.Windows" Version="5.0.0" />
1616
<PackageReference Include="System.Text.Encoding.CodePages" Version="6.0.0" />
17-
<PackageReference Include="System.Text.Json" Version="6.0.0" />
17+
<!-- Manual upgrade from 6.0.0 to address CVE-2024-43485 -->
18+
<PackageReference Include="System.Text.Json" Version="6.0.10" />
1819
<PackageReference Include="System.Threading.Tasks.Dataflow" Version="6.0.0" />
1920
</ItemGroup>
2021

‎src/referencePackages/src/microsoft.build/17.3.4/microsoft.build.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@
2424
<dependency id="System.Reflection.MetadataLoadContext" version="6.0.0" exclude="Build,Analyzers" />
2525
<dependency id="System.Security.Principal.Windows" version="5.0.0" exclude="Build,Analyzers" />
2626
<dependency id="System.Text.Encoding.CodePages" version="6.0.0" exclude="Build,Analyzers" />
27-
<dependency id="System.Text.Json" version="6.0.0" exclude="Build,Analyzers" />
27+
<!-- Manual upgrade from 6.0.0 to address CVE-2024-43485 -->
28+
<dependency id="System.Text.Json" version="6.0.10" exclude="Build,Analyzers" />
2829
<dependency id="System.Threading.Tasks.Dataflow" version="6.0.0" exclude="Build,Analyzers" />
2930
</group>
3031
</dependencies>

‎src/referencePackages/src/microsoft.extensions.dependencymodel/6.0.0/Microsoft.Extensions.DependencyModel.6.0.0.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@
99
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
1010
<PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="6.0.0" />
1111
<PackageReference Include="System.Text.Encodings.Web" Version="6.0.0" />
12-
<PackageReference Include="System.Text.Json" Version="6.0.0" />
12+
<!-- Manual upgrade from 6.0.0 to address CVE-2024-43485 -->
13+
<PackageReference Include="System.Text.Json" Version="6.0.10" />
1314
<PackageReference Include="System.Buffers" Version="4.5.1" />
1415
<PackageReference Include="System.Memory" Version="4.5.4" />
1516
</ItemGroup>

‎src/referencePackages/src/microsoft.extensions.dependencymodel/6.0.0/microsoft.extensions.dependencymodel.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@ Microsoft.Extensions.DependencyModel.DependencyContext</description>
1919
<group targetFramework=".NETStandard2.0">
2020
<dependency id="System.Runtime.CompilerServices.Unsafe" version="6.0.0" exclude="Build,Analyzers" />
2121
<dependency id="System.Text.Encodings.Web" version="6.0.0" exclude="Build,Analyzers" />
22-
<dependency id="System.Text.Json" version="6.0.0" exclude="Build,Analyzers" />
22+
<!-- Manual upgrade from 6.0.0 to address CVE-2024-43485 -->
23+
<dependency id="System.Text.Json" version="6.0.10" exclude="Build,Analyzers" />
2324
<dependency id="System.Buffers" version="4.5.1" exclude="Build,Analyzers" />
2425
<dependency id="System.Memory" version="4.5.4" exclude="Build,Analyzers" />
2526
</group>

‎src/referencePackages/src/nuget.protocol/6.11.0/NuGet.Protocol.6.11.0.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@
1212

1313
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
1414
<PackageReference Include="NuGet.Packaging" Version="6.11.0" />
15-
<PackageReference Include="System.Text.Json" Version="7.0.3" />
15+
<!-- Manual upgrade from 7.0.3 to address CVE-2024-30105 -->
16+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
1617
</ItemGroup>
1718

1819
</Project>

‎src/referencePackages/src/nuget.protocol/6.11.0/nuget.protocol.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
</group>
2020
<group targetFramework=".NETStandard2.0">
2121
<dependency id="NuGet.Packaging" version="6.11.0" exclude="Build,Analyzers" />
22-
<dependency id="System.Text.Json" version="7.0.3" exclude="Build,Analyzers" />
22+
<!-- Manual upgrade from 7.0.3 to address CVE-2024-30105 -->
23+
<dependency id="System.Text.Json" version="8.0.5" exclude="Build,Analyzers" />
2324
</group>
2425
</dependencies>
2526
</metadata>

‎src/referencePackages/src/nuget.protocol/6.12.1/NuGet.Protocol.6.12.1.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@
1212

1313
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
1414
<PackageReference Include="NuGet.Packaging" Version="6.12.1" />
15-
<PackageReference Include="System.Text.Json" Version="8.0.4" />
15+
<!-- Manual upgrade from 8.0.4 to address CVE-2024-43485 -->
16+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
1617
</ItemGroup>
1718

1819
</Project>

‎src/referencePackages/src/nuget.protocol/6.12.1/nuget.protocol.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
</group>
2020
<group targetFramework=".NETStandard2.0">
2121
<dependency id="NuGet.Packaging" version="6.12.1" exclude="Build,Analyzers" />
22-
<dependency id="System.Text.Json" version="8.0.4" exclude="Build,Analyzers" />
22+
<!-- Manual upgrade from 8.0.4 to address CVE-2024-43485 -->
23+
<dependency id="System.Text.Json" version="8.0.5" exclude="Build,Analyzers" />
2324
</group>
2425
</dependencies>
2526
</metadata>

‎src/referencePackages/src/nuget.protocol/6.8.1/NuGet.Protocol.6.8.1.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@
1212

1313
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
1414
<PackageReference Include="NuGet.Packaging" Version="6.8.1" />
15-
<PackageReference Include="System.Text.Json" Version="7.0.3" />
15+
<!-- Manual upgrade from 7.0.3 to address CVE-2024-30105 -->
16+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
1617
</ItemGroup>
1718

1819
</Project>

‎src/referencePackages/src/nuget.protocol/6.8.1/nuget.protocol.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
</group>
2020
<group targetFramework=".NETStandard2.0">
2121
<dependency id="NuGet.Packaging" version="6.8.1" exclude="Build,Analyzers" />
22-
<dependency id="System.Text.Json" version="7.0.3" exclude="Build,Analyzers" />
22+
<!-- Manual upgrade from 7.0.3 to address CVE-2024-30105 -->
23+
<dependency id="System.Text.Json" version="8.0.5" exclude="Build,Analyzers" />
2324
</group>
2425
</dependencies>
2526
</metadata>

‎src/referencePackages/src/system.security.cryptography.cng/5.0.0/System.Security.Cryptography.Cng.5.0.0.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@
66
</PropertyGroup>
77

88
<ItemGroup Condition="'$(TargetFramework)' == 'netcoreapp3.0'">
9-
<PackageReference Include="System.Formats.Asn1" Version="5.0.0" />
9+
<!-- Manual upgrade from 5.0.0 to address CVE-2024-38095 -->
10+
<PackageReference Include="System.Formats.Asn1" Version="6.0.1" />
1011
</ItemGroup>
1112

1213
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard1.3'">

‎src/referencePackages/src/system.security.cryptography.cng/5.0.0/system.security.cryptography.cng.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ When using NuGet 3.x this package requires at least version 3.4.</description>
2525
<repository type="git" url="git://github.com/dotnet/runtime" commit="cf258a14b70ad9069470a108f13765e0e5988f51" />
2626
<dependencies>
2727
<group targetFramework=".NETCoreApp3.0">
28-
<dependency id="System.Formats.Asn1" version="5.0.0" exclude="Compile" />
28+
<!-- Manual upgrade from 5.0.0 to address CVE-2024-38095 -->
29+
<dependency id="System.Formats.Asn1" version="6.0.1" exclude="Compile" />
2930
</group>
3031
<group targetFramework=".NETStandard1.3">
3132
<dependency id="System.IO" version="4.3.0" />

‎src/referencePackages/src/system.security.cryptography.pkcs/6.0.1/System.Security.Cryptography.Pkcs.6.0.1.csproj

Lines changed: 0 additions & 27 deletions
This file was deleted.

0 commit comments

Comments
 (0)