search

mbdavid / LiteDB

LiteDB - A .NET NoSQL Document Store in a single data file
http://www.litedb.org
MIT License
8.62k stars 1.25k forks source link

[QUESTION] Release of the LiteDB v4 with security vulnerability patches on NuGet #2556

Open ezioleq opened 1 month ago

ezioleq commented 1 month ago

Some time ago the CVE-2022-23535 vulnerability was fixed for the forth version of LiteDB. Accorting to the comment on the closed Pull Request with the patch, there's should be a tag for this patched version, but I couldn't find it. Did you accidentally miss it? 😅

Secondly, I'd really love to see the patched version on NuGet. It would be a lot easier and safer just to update the NuGet package than utilizing submodules/forking or cloning the repository just to be able to use it. My team and I cannot afford to update the LiteDB to v5 at this moment, as it's causing too many breaking changes for us.

Is the release of the patched version of LiteDB v4 possible or planned? If so, when we can expect it? Or did I miss something? I'd be happy to hear from you 😄

CC @mbdavid (sorry for CC'ing you, but I feel like you're the executive in those matters)

viveleltsi commented 1 week ago

I made this PR. But FYI there was another fix on the main branch who include a bunch of different namespace to ban to fix the security issue when deserializing. So this PR is probably not enough to fix it.