search

FortuneN / FineCodeCoverage

Visualize unit test code coverage easily for free in Visual Studio Community Edition (and other editions too)
https://marketplace.visualstudio.com/items?itemName=FortuneNgwenya.FineCodeCoverage
Other
506 stars 38 forks source link

CVE 2018-1285 critical vulnerability #426

Open totszwai opened 1 month ago

totszwai commented 1 month ago

Hello, this extension is being flagged with a critical vulnerability

image

Looks like FineCodeCoverage is using an extremely old version of Apache log4net, they already had a fix for this 4 years ago. https://github.com/apache/logging-log4net/releases

totszwai commented 1 month ago

I took the latest release from log4net, version 2.0.17. Grabbed the DLL from the net45 folder and replaced it in my local install of FineCodeCoverage, which seems to get rid of the vulnerability flagging and FineCodeCoverage extension seem to still run just fine.