microsoft / microsoft/AdaptiveCards
[Library] AdaptiveCards .NET Library High Severity Vulnerability for Newtonsoft.Json Dependency
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2k
- Forks
- 595
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 1
Description
Target Platforms
Other
SDK Version
3.1
Application Name
Teams
Problem Description
There wasn't a great issue template to report this, so I chose the Rendering one, as the .NET Library package resides alongside the rendering packages. Forgive me if there was a better option to use.
Issue:
Visual Studio is reporting a high severity vulnerability in Newtonsoft.Json 11.0.2, which is a dependency of this package for .NET FW and .NETStandard:
Package 'Newtonsoft.Json' 11.0.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
Looks like Newtonsoft.Json 13.0.3 is being correctly applied to .Net6, but not the other supported frameworks of the package.
Screenshots
Card JSON
{}
Sample Code Language
No response
Sample Code
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the .NET Framework and .NETStandard dependency declarations for the library and compare them with the .NET 6 dependency resolution described in the issue. Confirm how Newtonsoft.Json 11.0.2 is selected for the affected targets; done means supported frameworks resolve a non-vulnerable version and the reported high-severity warning is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100