Azure / Azure/azure-functions-openapi-extension

Multiple transitive security vulnerabilities

Open
#550 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
388
Forks
202
PR merge metrics
No merged PRs in 30d

Description

**Describe the issue**
One project I am working on for a client has recently undergone penetration testing. One result of this pen testing revealed several microservices have security vulnerabilities due to transitive NuGet packages. This is easy to verify using a simple CLI command.

**To Reproduce**
Steps to reproduce the behavior:
1. Checkout the source from the repo
2. Build the solution
3. Execute the following command line from the local directory : dotnet list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json
4. The dotnet CLI will output a lengthy list of transitive NuGet packages that have security vulnerabilities.

**Expected behavior**
The result of the dotnet CLI command should result in zero security vulnerabilities

**Screenshots**
![Screenshot 2023-02-07 134932](https://user-images.githubusercontent.com/50671522/217350135-436767a1-97ca-4c98-9fdb-99b384f17d0a.png)

Contributor guide

Open the contributing guide

Research direction

Check out the repository, build the solution, and run `dotnet list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json` from the local directory. Review the reported transitive NuGet vulnerabilities across the microservices and determine whether the result can be reduced to zero; the issue does not identify specific packages or project files.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.