Skip to content

Conversation

@JanKrivanek
Copy link
Member

Fixes CVE-2023-29331

Context

CVE-2023-29331

Changes Made

Version bump that should have been done by dependabot

@JanKrivanek
Copy link
Member Author

@MichaelSimons - Is it possible to reference system.security.cryptography.pkcs.7.0.2 as an external nuget? This worked just fine for 7.0.0 - however I do not see 7.0.2 being supported: https://github.com/dotnet/source-build-reference-packages/tree/main/src/referencePackages/src/system.security.cryptography.pkcs Is that planned to be added? (as 7.0.0 and 7.0.1 have known vulnerabilities)

@MichaelSimons
Copy link
Member

@MichaelSimons - Is it possible to reference system.security.cryptography.pkcs.7.0.2 as an external nuget? This worked just fine for 7.0.0 - however I do not see 7.0.2 being supported: https://github.com/dotnet/source-build-reference-packages/tree/main/src/referencePackages/src/system.security.cryptography.pkcs Is that planned to be added? (as 7.0.0 and 7.0.1 have known vulnerabilities)

source-build-reference-packages is a self servicing repo. If you need a new package added which it appears like it is, you can add it yourself following these instructions. If you need any help I will be glad to help.

@JanKrivanek
Copy link
Member Author

New version added to dotnet/source-build-reference-packages - however to be able to use it we need to reference the latest version - that is currently blocked by #8893

@JanKrivanek
Copy link
Member Author

@dotnet/source-build-internal - Adding System.Security.Cryptography.Pkcs/*7.0.2* to prebuild as a temporary workaround, so that we can update the vulnerable package.

The proper solution will require SRBP update, which will require update to arcade 8 - so this will need a bit of time

@JanKrivanek JanKrivanek force-pushed the JanKrivanek-patch-4 branch from a3e8d15 to 4a87b6b Compare June 21, 2023 18:24
@JanKrivanek JanKrivanek merged commit 227092b into main Jun 22, 2023
@JanKrivanek JanKrivanek deleted the JanKrivanek-patch-4 branch June 22, 2023 05:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants