Azure / Azure/azure-functions-openapi-extension
Multiple transitive security vulnerabilities
- Dominant language
- C#
- Stars
- 388
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the issue**
One project I am working on for a client has recently undergone penetration testing. One result of this pen testing revealed several microservices have security vulnerabilities due to transitive NuGet packages. This is easy to verify using a simple CLI command.
**To Reproduce**
Steps to reproduce the behavior:
1. Checkout the source from the repo
2. Build the solution
3. Execute the following command line from the local directory : dotnet list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json
4. The dotnet CLI will output a lengthy list of transitive NuGet packages that have security vulnerabilities.
**Expected behavior**
The result of the dotnet CLI command should result in zero security vulnerabilities
**Screenshots**

Contributor guide
Research direction
Check out the repository, build the solution, and run `dotnet list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json` from the local directory. Review the reported transitive NuGet vulnerabilities across the microservices and determine whether the result can be reduced to zero; the issue does not identify specific packages or project files.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100