Smartstore.Test.Common-6.0.0: 1 vulnerabilities (highest severity is: 9.1) reachable

[mend-for-github-com]

Vulnerable Library - Smartstore.Test.Common-6.0.0

Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuget.packaging/6.6.1/nuget.packaging.6.6.1.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Smartstore.Test.Common version)	Remediation Possible**	Reachability
CVE-2024-0057	Critical	9.1	nuget.packaging.6.6.1.nupkg	Transitive	N/A*	❌	Reachable

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-0057

Vulnerable Library - nuget.packaging.6.6.1.nupkg

NuGet's understanding of packages. Reading nuspec, nupkgs and package signing.

Library home page: https://api.nuget.org/packages/nuget.packaging.6.6.1.nupkg

Path to dependency file: /src/Smartstore.Modules/Smartstore.Microsoft.Auth/Smartstore.Microsoft.Auth.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuget.packaging/6.6.1/nuget.packaging.6.6.1.nupkg

Dependency Hierarchy:

• Smartstore.Test.Common-6.0.0 (Root Library)
  • Smartstore-6.0.0
    • nuget.protocol.6.6.1.nupkg
      • ❌ nuget.packaging.6.6.1.nupkg (Vulnerable Library)

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

Smartstore.Engine.Modularity.NuGet.NuGetExtensions (Application)
  -> NuGet.Packaging.PackageArchiveReader (Extension)
   -> NuGet.Packaging.Signing.PrimarySignature (Extension)
    -> NuGet.Packaging.Signing.SignatureUtility (Extension)
     -> ❌ NuGet.Packaging.Signing.X509CertificateChain (Vulnerable Component)

Vulnerability Details

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-0057

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-68w7-72jg-6qpp

Release Date: 2024-01-09

Fix Resolution: NuGet.CommandLine - 5.11.6,6.0.6,6.3.4,6.4.3,6.6.2,6.7.1,6.8.1, NuGet.Packaging - 5.11.6,6.0.6,6.3.4,6.4.3,6.6.2,6.7.1,6.8.1