danielgerlag / danielgerlag/conductor

Full of Vulnerable Nuget Packages

Open
#50 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
589
Forks
99
PR merge metrics
No merged PRs in 30d

Description

This repo is full of vulnerable nuget packages in both top level and transitive packages. Some of the vulnerabilities are years old.
Here's the list for the top level vulnerable packages:
Microsoft.AspNetCore.App 2.2.0 https://github.com/advisories/GHSA-6px8-22w5-w334 and https://github.com/advisories/GHSA-prrf-397v-83xh
Microsoft.NETCore.App 2.2.0 https://github.com/advisories/GHSA-6px8-22w5-w334 and https://github.com/advisories/GHSA-2xjx-v99w-gqf3 and https://github.com/advisories/GHSA-x5qj-9vmx-7g6g
MongoDB.Driver 2.10.0 https://github.com/advisories/GHSA-7j9m-j397-g4wx
Newtonsoft.Json 12.0.3 https://github.com/advisories/GHSA-5crp-9r3c-p9vr
System.IdentityModel.Tokens.Jwt 5.6.0 https://github.com/advisories/GHSA-59j7-ghrg-fj52

In the transitive package vulnerabilities there are two critical vulnerabilities with 9.8 ratings.
https://github.com/advisories/GHSA-w65q-jcmv-28gj published in 2023 is remote code execution
https://github.com/advisories/GHSA-w65q-jcmv-28gj published in 2021 is also remote code execution
All of these vulnerable packages have patched versions that fix the vulnerabilities.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.