System.ServiceModel.Primitives 8.0.0 transivitely uses vulnerable package System.Security.Cryptography.Pkcs 6.0.1
Open
triaged
- Dominant language
- C#
- Stars
- 1.8k
- Forks
- 576
- Avg merge
- 6d 9h
- Merged PRs (30d)
- 2
Description
System.ServiceModel.Primitives 8.0.0 has dependency System.Security.Cryptography.Xml >= 6.0.1
System.Security.Cryptography.Xml 6.0.1 has depency System.Security.Cryptography.Pkcs 6.0.1 which is marked vulnerable
Visual Studio 2022 transitive package installation installs minimum required package version, which is the vulnerable version
Please update package dependecies of System.ServiceModel.Primitives 8.0.0
Contributor guide
Assessment
This issue has not been assessed yet.