Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Informational: some used NuGet packages have reported vulnerabilities #16

Open
vbaderks opened this issue Dec 23, 2024 · 1 comment
Open

Comments

@vbaderks
Copy link

Hi CrypToolProject,

When building your project in Visual Studio 2022 17.12.3 I noticed the following warnings:

NU1902: Package 'BouncyCastle' 1.8.5 has a known moderate severity vulnerability, GHSA-6xx3-rg99-gc3p
NU1903: Package 'Google.Protobuf' 3.6.1 has a known high severity vulnerability, GHSA-77rm-9x9h-xj3g
NU1903: Package 'Newtonsoft.Json' 12.0.3 has a known high severity vulnerability, GHSA-5crp-9r3c-p9vr

Note 1: if needed, I could create a PR to upgrade these NuGet packages to a version that has these issues resolved.
Note 2: Your project doesn't have a Contributing Guidelines or a Security policy listed, so I hope opening an issue like this is ok.

@n1k0m0
Copy link
Collaborator

n1k0m0 commented Dec 24, 2024

Hiho,
Thanks for the hint -- we replaced the mentioned libs with the newest versions. Also, we removed nuget so far from CT2 since it broke our build process. Adding full nuget support is a future task. Also, we will add contribution guidelines.
Kind regards,
Nils

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants