Transitive CVE in System.Runtime.Caching

[SimonCropp]

can you update to 8.0.1 and release a new nuget

[Xyloto91]

Have same issue due to Trivy vulnerability scan, pls update this so we don't need to update transitive dependency.

[jaskaransinghdr6j]

+1 being flagged by Anchore and other GH feeds

[mungojam]

It seems like in general if the Microsoft.Data.SqlClient package were updated to use v8.x rather than v6.x of various dependencies, all this noise would go away as the sub-dependencies like Microsoft.IdentityModel.Protocols.OpenIdConnect have been updated so that they just rely on the .net core provided versions instead.

The current tree looks like this (for a different vulnerability)

               └─ Microsoft.Data.SqlClient (v5.2.2)
                  ├─ Azure.Identity (v1.12.0)
                  │  └─ Azure.Core (v1.40.0)
                  │     ├─ System.ClientModel (v1.0.0)
                  │     │  └─ System.Memory.Data (v1.0.2)
                  │     │     └─ System.Text.Encodings.Web (v4.7.2)
                  │     ├─ System.Memory.Data (v1.0.2)
                  │     │  └─ System.Text.Encodings.Web (v4.7.2)
                  │     └─ System.Text.Encodings.Web (v4.7.2)
                  ├─ Microsoft.IdentityModel.JsonWebTokens (v6.35.0)
                  │  └─ System.Text.Encodings.Web (v4.7.2)
                  └─ Microsoft.IdentityModel.Protocols.OpenIdConnect (v6.35.0)
                     └─ System.IdentityModel.Tokens.Jwt (v6.35.0)
                        └─ Microsoft.IdentityModel.JsonWebTokens (v6.35.0)
                           └─ System.Text.Encodings.Web (v4.7.2)

[weldevops]

We use this package in our most widely used library and functionally every one of our services is screaming about vulnerabilities.

Is there a rough estimate when the updates might be released or should we override this dependency so long as it may be a while?

Can we assist with the patching at all?

[roji]

Everyone, you can take a direct dependency on System.Runtime.Caching 8.0.1 from your project; there's no need to wait until SqlClient releases.

[benrr101]

It looks like we updated the dependency was updated in v6, but will need to be backported to previous, supported releases.

[ErikEJ]

@benrr101 Is there an issue to Backport to current releases?

[ErikEJ]

@benrr101 Sorry, just saw you created one 😄

[David-Engel]

Backport tracking issue: #2935