Closed mend-bolt-for-github[bot] closed 4 months ago
nuget.common.5.11.0.nupkg
Common utilities and interfaces for all NuGet libraries.
Library home page: https://api.nuget.org/packages/nuget.common.5.11.0.nupkg
Path to dependency file: /build/_build.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuget.common/5.11.0/nuget.common.5.11.0.nupkg
Dependency Hierarchy: - nuke.common.6.1.1.nupkg (Root Library) - nuget.packaging.5.11.0.nupkg - nuget.configuration.5.11.0.nupkg - :x: **nuget.common.5.11.0.nupkg** (Vulnerable Library)
Cross-platform build automation system Signed by signpath.io from repository 'https://github.com/nuk...
Library home page: https://api.nuget.org/packages/nuke.common.6.1.1.nupkg
Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuke.common/6.1.1/nuke.common.6.1.1.nupkg
Dependency Hierarchy: - :x: **nuke.common.6.1.1.nupkg** (Vulnerable Library)
Found in HEAD commit: 300ffe1d117d8271fbdec90f09da40d1cdf2e105
Found in base branch: main
NuGet Client Remote Code Execution Vulnerability
Publish Date: 2023-06-14
URL: CVE-2023-29337
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-6qmf-mmc7-6c2p
Release Date: 2023-06-14
Fix Resolution: NuGet.CommandLine - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.Commands - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.Common - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.PackageManagement - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.Protocol - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1
Step up your Open Source Security Game with Mend here
CVE-2023-29337 - High Severity Vulnerability
nuget.common.5.11.0.nupkg
Common utilities and interfaces for all NuGet libraries.
Library home page: https://api.nuget.org/packages/nuget.common.5.11.0.nupkg
Path to dependency file: /build/_build.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuget.common/5.11.0/nuget.common.5.11.0.nupkg
Dependency Hierarchy: - nuke.common.6.1.1.nupkg (Root Library) - nuget.packaging.5.11.0.nupkg - nuget.configuration.5.11.0.nupkg - :x: **nuget.common.5.11.0.nupkg** (Vulnerable Library)
nuke.common.6.1.1.nupkg
Cross-platform build automation system Signed by signpath.io from repository 'https://github.com/nuk...
Library home page: https://api.nuget.org/packages/nuke.common.6.1.1.nupkg
Path to dependency file: /build/_build.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuke.common/6.1.1/nuke.common.6.1.1.nupkg
Dependency Hierarchy: - :x: **nuke.common.6.1.1.nupkg** (Vulnerable Library)
Found in HEAD commit: 300ffe1d117d8271fbdec90f09da40d1cdf2e105
Found in base branch: main
NuGet Client Remote Code Execution Vulnerability
Publish Date: 2023-06-14
URL: CVE-2023-29337
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-6qmf-mmc7-6c2p
Release Date: 2023-06-14
Fix Resolution: NuGet.CommandLine - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.Commands - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.Common - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.PackageManagement - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1, NuGet.Protocol - 6.0.5,6.2.4,6.3.3,6.4.2,6.5.1,6.6.1
Step up your Open Source Security Game with Mend here