Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data.
The System.Text.Json library is built-in as part of the shared framework in .NET Runtime. The package can be installed when you need to use it in other target frameworks.
Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data.
The System.Text.Json library is built-in as part of the shared framework in .NET Runtime. The package can be installed when you need to use it in other target frameworks.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - system.text.json.8.0.4.nupkg
Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data. The System.Text.Json library is built-in as part of the shared framework in .NET Runtime. The package can be installed when you need to use it in other target frameworks.
Library home page: https://api.nuget.org/packages/system.text.json.8.0.4.nupkg
Path to dependency file: /Vonage/Vonage.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/8.0.4/system.text.json.8.0.4.nupkg
Found in HEAD commit: f11e417735d73e1c68aadebbd42df4c44b6e7e4c
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-43485
### Vulnerable Library - system.text.json.8.0.4.nupkgProvides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data. The System.Text.Json library is built-in as part of the shared framework in .NET Runtime. The package can be installed when you need to use it in other target frameworks.
Library home page: https://api.nuget.org/packages/system.text.json.8.0.4.nupkg
Path to dependency file: /Vonage/Vonage.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/8.0.4/system.text.json.8.0.4.nupkg
Dependency Hierarchy: - :x: **system.text.json.8.0.4.nupkg** (Vulnerable Library)
Found in HEAD commit: f11e417735d73e1c68aadebbd42df4c44b6e7e4c
Found in base branch: main
### Vulnerability Details.NET and Visual Studio Denial of Service Vulnerability
Publish Date: 2024-10-08
URL: CVE-2024-43485
### Threat AssessmentExploit Maturity: Unproven
EPSS: 0.0%
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-8g4q-xg66-9fp4
Release Date: 2024-10-08
Fix Resolution: System.Text.Json - 6.0.10,8.0.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.