Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Transitive dependencies have high/critical security vulnerabilities

See original GitHub issue

Add this package to a blank project and run dotnet list package --vulnerable --include-transitive

Project `MyApp` has the following vulnerable packages
   [net6.0]: 
   Transitive Package               Resolved   Severity   Advisory URL                                     
   > Newtonsoft.Json                9.0.1      High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr
   > System.Text.Encodings.Web      4.5.0      Critical   https://github.com/advisories/GHSA-ghhp-997w-qr28

Issue Analytics

State:
Created a year ago
Comments:5 (3 by maintainers)

Top GitHub Comments

1reaction

jskeetcommented, Oct 10, 2022

@mattjohnsonpint: Please could you see whether https://github.com/cloudevents/sdk-csharp/issues/239 and https://github.com/cloudevents/sdk-csharp/pull/240 look like the right approach to you?

1reaction

jskeetcommented, Oct 8, 2022

Will sort this out on Monday, thanks.

Top Results From Across the Web

Analyzing the Direct and Transitive Impact of Vulnerabilities ...

vulnerabilities may influence libraries via long transitive dependency chains and that a vulnerability in a single library may.

Transitive Dependencies: How much can you trust friends of ...

In a nutshell, transitive dependencies are the components that are necessary for the Open Source Software (OSS) your app uses to run, compile...

78% of vulnerabilities are found in indirect dependencies ...

78% of vulnerabilities are found in indirect dependencies, making remediation complex. Keep your open source dependencies secure. Snyk provides ...

.NET Handbook | Best practices / Vulnerable dependencies

The next step is determining whether that vulnerability is actually afflicting ... The severity can be minimal, medium, high, or critical.

On the Effect of Transitivity and Granularity on Vulnerability ...

Our main empirical findings shows that, (1) transitivity has a substantial impact on the vulnerabilities propagation in Maven. Of 1.1M vulnerable projects, ...