Bump dependency System.Configuration.ConfigurationManager to 6.0.0 to avoid vulnerability issues with System.Drawing.Common 4.7.0

Currently this project has a dependency on System.Configuration.ConfigurationManager version 4.7.0

In a project I work on we use Trivy for container scanning purposes. This reported issue CVE-2021-24112 because of a dependency on System.Drawing.Common version 4.7.0.

┌───────────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────┐
│        Library        │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                    Title                    │
├───────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────┤
│ System.Drawing.Common │ CVE-2021-24112 │ CRITICAL │ 4.7.0             │ 5.0.3, 4.7.2  │ dotnet: Remote Code Execution Vulnerability │
│                       │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2021-24112  │
└───────────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────┘

After a while, I figured out that we had this dll because of Quartz. Quartz has this dependency because of System.Configuration.ConfigurationManager

This issue is fixed in 5.0.3, 4.7.2 (or 6.x.x).

I recommend updating SYstem.ConfigurationManager to the latest 6.x.x version so this vulnerability will be fixed.

[lahma]

Wow, that’s a weird dependency tree. Thanks for sharing!

[lahma]

OK now we’re at version 6.0.1 at 3.x branch I’ll remove the whole dependency on main (4.x).