Skip to content

Conversation

@DavoudEshtehari
Copy link
Contributor

Addresses CVE-2024-35255

@ErikEJ
Copy link
Contributor

ErikEJ commented Jul 4, 2024

@DavoudEshtehari Should I close #2578 then?

@DavoudEshtehari
Copy link
Contributor Author

@ErikEJ Thank you for mentioning your PRs here. I hesitated to remove MIC on servicing versions.
@David-Engel What's your preference?

@ErikEJ
Copy link
Contributor

ErikEJ commented Jul 4, 2024

@DavoudEshtehari Agree, I will close my PRs

@ErikEJ
Copy link
Contributor

ErikEJ commented Jul 4, 2024

LGTM

@cremor
Copy link

cremor commented Jul 10, 2024

This was fixed in the main branch by #2577 Wouldn't it make sense to use that change for the 5.1 branch too?
Related question: #2568 (comment)

Also, here is a request to bump further: #1108 (comment)

@DavoudEshtehari
Copy link
Contributor Author

DavoudEshtehari commented Jul 10, 2024

This was fixed in the main branch by #2577 Wouldn't it make sense to use that change for the 5.1 branch too? Related

This is already asked by Erik and he's agree with the argue.

@cremor
Copy link

cremor commented Jul 10, 2024

Ok, but what about #1108 (comment)?
If I understand that correctly then the Azure dependency currently causes SqlClient to depend on the Windows Desktop runtime. And that dependency also flows to EF Core. (And that is relevant here because EF Core depends on SqlClient v5.1.)

@ErikEJ
Copy link
Contributor

ErikEJ commented Jul 10, 2024

Have you tried adding an Explict reference to the latest version??

@cremor
Copy link

cremor commented Jul 10, 2024

Yes, I'm already doing that.
But still, if nothing speaks against it, the issue should be fixed here to spare others from losing time to it.

@SimonCropp
Copy link
Contributor

can we please get a patch out for this

@ErikEJ
Copy link
Contributor

ErikEJ commented Jul 20, 2024

@SimonCropp and others: Please read this: https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/

In particular the section "Recommended way to resolve warnings"

@SimonCropp
Copy link
Contributor

@ErikEJ that doc is poorly worded. it should be phrased

the way to temporary work around a transitive CVE is to add a direct reference. then, when the transitive CVE is fixed, that direct reference can be removed

we are are now at the second part.

@DavoudEshtehari DavoudEshtehari merged commit f63ae8f into dotnet:release/5.1 Jul 25, 2024
@SimonCropp
Copy link
Contributor

if this is important enough to be included in a hotfix for an older version, doesnt it also qualify for a release of hotfix on the current version?

@cremor
Copy link

cremor commented Jul 25, 2024

@SimonCropp See #2648 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants