Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE-2024-30105 #680

Merged
merged 3 commits into from
Jul 15, 2024
Merged

Conversation

304NotModified
Copy link
Contributor

@304NotModified 304NotModified commented Jul 15, 2024

System.Text.Json <= 8.0.3 has the CVE-2024-30105

System.Text.Json is a dependency of Microsoft.Extensions.Configuration.Json, but there isn't a update of that package.

TODO

  • update all version numbers?
  • update changelog

Fixes #681

Please release a new version of the global tool after merging :)

@304NotModified
Copy link
Contributor Author

I think there a multiple version numbers that needs an update. Could you do that for me? I can't edit this project locally (blocked), only in the browser

@danielpalme danielpalme merged commit 079ffc7 into danielpalme:main Jul 15, 2024
6 checks passed
@danielpalme
Copy link
Owner

Thank you. New release is now available.

@304NotModified 304NotModified deleted the fix-CVE-2024-30105 branch July 16, 2024 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

dotnet-reportgenerator-globaltool uses old System.Text.Json and reports CVE-2024-30105
2 participants