search

starkbank / ecdsa-dotnet

A lightweight and fast pure C# ECDSA library
https://starkbank.com
Other
49 stars 20 forks source link

Use nuget.org package status "vulnerable" for affected versions (CVE-2021-43569) #22

Closed Bertk closed 2 years ago

Bertk commented 2 years ago

Please use the nuget.org feature to mark vulnerable packages.

We use the following command in our CI build pipeline to break the build and some starkbank-ecdsa versions with CVE-2021-43569 are not detected.

dotnet list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json

see How to Scan NuGet Packages for Security Vulnerabilities

Bertk commented 2 years ago

Thank you for your fast response 👍

image