From dd6b175336362e480a4ef05f2e1873cd6554ba53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Thu, 14 Apr 2022 16:28:17 +0200
Subject: [PATCH] Patched CVE-2017-11770 and CVE-2019-0981 (#3578)

* Patched CVE-2017-11770.
* Patched CVE-2019-0981.

Co-authored-by: Medeni Baykal <433724+Haplois@users.noreply.github.com>
---
 .../Microsoft.TestPlatform.Protocol.csproj     |   4 ++++
 .../SelfContainedAppTestProject.csproj         | Bin 1516 -> 864 bytes
 2 files changed, 4 insertions(+)

diff --git a/samples/Microsoft.TestPlatform.Protocol/Microsoft.TestPlatform.Protocol.csproj b/samples/Microsoft.TestPlatform.Protocol/Microsoft.TestPlatform.Protocol.csproj
index 98f259f429..21f998a2d1 100644
--- a/samples/Microsoft.TestPlatform.Protocol/Microsoft.TestPlatform.Protocol.csproj
+++ b/samples/Microsoft.TestPlatform.Protocol/Microsoft.TestPlatform.Protocol.csproj
@@ -6,6 +6,10 @@
     <OutputType>Exe</OutputType>
   </PropertyGroup>
   <ItemGroup>
+    <!-- CVE-2017-11770 -->
+    <PackageReference Include="System.Security.Cryptography.X509Certificates" Version="4.1.2" />
+    <!-- / CVE-2017-11770 -->
+
     <PackageReference Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
     <PackageReference Include="Newtonsoft.Json">
       <Version>9.0.1</Version>
diff --git a/test/TestAssets/SelfContainedAppTestProject/SelfContainedAppTestProject.csproj b/test/TestAssets/SelfContainedAppTestProject/SelfContainedAppTestProject.csproj
index e6980294b6677f93ac713e298dc8d8f2ffa8a1fc..1c229db8ca04ef4baf5dd3936a428f91f5dae13e 100644
GIT binary patch
literal 864
zcmb7DJ#X7E5Z(1Fu0)1(5M?DnkN}c`AaDy0X^q&;<b{<^4r_@d$Wv_p`;xM1t4TWq
zAVlch-Fx@N>~7aK@QT(+t#X#~2?JE6uB2M$tfM-<VRuE8&8_~0CBdTF<m^$FRy$o2
z|2AE653wQw$Uem}%vz%@Ie5@*s}(HK(Y<r%5o5J+9OAh5J@~;un={T=hvP~s4Y}3N
zPBzu*6wmv321yYGEgxvm(*CQ}oe7K{TMD~I`eH?kTWvS4P)Mb=D2%z}X_maR2c{u!
zdeIJnwz|*LGfQ-^l}!V!*m%PWf~Nt8O&yn7k&p_jp%_o`)G3lJ&MNeGEzuTRsnSWj
zyS~bj_r`<n_l`_Q%e}#3y2C6P{f82hH#G)qM%a!^4lRFpp2ioG^fsQ{-lV6L=Azt)
zH9ldD)=v~+rpl(PFlURs^E7;J<*Oj%KdfZ%{AUBM_$9yS+kEUz@^OjBMVK59pW{46
zB4_6Zhofzf|9leufBGZt`$`x>`w!;9@*&>8wz|(htoErjXXk$11McBB#91<$Ow^Aq
IJeMN+4Vu~(N&o-=

literal 1516
zcmb`HL2uJQ5QX2l68~YTIKZK9D-fsPszL?jP^e18DHoGEZJNZj;)I4j4}3EllWy85
z94gE9+Vf`S&70Z%^Sh%HEj86dK|fV$rbZ*(snQ4S>sXnNcn2(%2K>LmTIt%Y3(Ymu
z0jT$2PL%6~_SDe@QSNk$&j3WwH@wE~agO)Etqq7F)=Xb?rXKHz+FwNp_;vJ>=m)I2
zFs$*I;nDE@k@b|zcm}*n{?2vEvtb=Ewdbk%lYy}~kzb7bFk;wXY?WtR{p8s=^AS8O
zeqTSdpqdG_^`B&rfixYAfhl;n%5NG)4pFBX##YxaeRli;k2TYX?5V(Z?X`VkRZx4W
zdsk#k{2U#uZtKvDRY8neZ{dH8iihyq<!`K7W~ugb-4NAu4P>yKf!MLK$b5v&x^nM&
z*d$HKH(q(%_&YKR9%tfHV_YjD7CuoWI&O9;^0-82!;QS=E;yS-`yO%|gWNM$)Otjh
zmrUb3ulj#H)0)4MYfg3c?9mbHP0oBSd7F+;+uIn1*wxcDwo8tZnzncS0&NE9Sa|0z
zK@YjDzqS{xA6;Kf;A^Vb+@7<K+WnCITRol`o5=4T?csiZrPoP>$9}2Ln`E-BU$JM;
z$NZGaY<5hmnP*EGSk0TPQ=b(7yo|S>X6qib=h`;C<N4R(BYGESo3w57V-vQX#P$@<
F^%uor_{;zR