mitigate cve-2021-26701 #3449
mitigate cve-2021-26701 #3449
Conversation
|
@jjoekoullas Thanks for opening this. I just encountered the same issue. Do you know if there's a way to fix this locally, while we wait for this PR to be merged? |
|
I ran into this with nswag.msbuild. Not really a good way around it for that - except maybe using a private nuget repo and publishing to it using this branch. If it's just because you're referencing nswag in your project - just referencing an updated System.Text.Encodings.Web will get you past this. That's actually what this fix is doing, just referencing an updating version since the problematic reference is in a dependency. |
|
@jjoekoullas Unfortunately I also ran into this with I may try the private nuget repo approach |
* mitigate cve-2021-26701 (RicoSuter#3449) Co-authored-by: Joe Koullas <[email protected]> * Update NJS * Update NR Co-authored-by: Joe <[email protected]> Co-authored-by: Joe Koullas <[email protected]> Co-authored-by: Rico Suter <[email protected]>
* mitigate cve-2021-26701 (RicoSuter#3449) Co-authored-by: Joe Koullas <[email protected]> * Update NJS * Update NR * v13.11.0 * Update to swagger-ui-3.48.0, RicoSuter#3451 * Allow UseAbortSignal for Aurelia, closes RicoSuter#3452 Co-authored-by: Joe <[email protected]> Co-authored-by: Joe Koullas <[email protected]> Co-authored-by: Rico Suter <[email protected]>
|
Thank you @RicoSuter ! |
|
Thanks for the PR. |
|
Thank you @RicoSuter - was just about to email you about this. @wyatt-troia - does this solve? |
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26701
just bumping version for system.text.encodings.web to mitigate the above cve.