System.Security.Cryptography.Pkcs 8.0.0 depends on vulnerable System.Formats.Asn1 8.0.0

[avivanoff]

Description

System.Security.Cryptography.Pkcs 8.0.0 depends on vulnerable System.Formats.Asn1 8.0.0.

Reproduction Steps

1. Create a project.
2. Add a reference to System.Security.Cryptography.Pkcs 8.0.0.
3. Enable transitive NuGet package analysis in the project.
4. Set warnings as error.

Expected behavior

No warnings or errors should be reported.

Actual behavior

An error is reported:

error NU1903: Warning As Error: Package 'System.Formats.Asn1' 8.0.0 has a known high severity vulnerability, GHSA-447r-wph3-92pm.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[vcsjones]

Closing as a duplicate of #105028.

Please use that issue for discussion and work arounds.