Giter VIP home page Giter VIP logo

nidirect-b2c-poc's Introduction

Hi I am Michael👋

🥇 Shortlisted for 2021 Digital DNA awards for Developer of the year

I am a developer who was previously in the Northern Ireland Civil Service in @dof-dss team but now working at Fujitsu UK & Ireland. I developed applications for all 9 NICS departments and I have also advised other civil service departments in the ROI and UK. I am now currently working in the private sector.

I use a variety of technologies and techniques i.e C#, SOLID, DotNet Core, MVC, api, ml.net, SQL, MySql, AWS, Cloud Foundry, Azure, Gov UK PaaS, CircleCI, AzureDevops, Units tests, UI tests etc...

💼 What you get with me

  • Lots and lots of hard work
  • Secure, maintainable, scalable, performant and accessible sites that comply to WCAG 2.1 AA standard
  • I use lots of tools that check software quality, security and accessibility
  • I craft sites that look the part as well as being functional
  • Expertise - I have covered alot of areas in 11 years of development
  • A genuine interest in your project and making things better
  • I always inject some of my own personality into projects and care about the products I craft and release
  • A thirst for learning new things
  • Being on time and keeping you up to date
  • I generally like to complete engagements from start to finish

🔭 I’m currently working on:

  • NI direct DotNet core template
  • Various class library toolkits

🌋 Recently completed projects:

  • Department of Education NI Exceptional closures application
  • Department of Education NI Apply to be a governor application
  • Department of Education NI Schools & Institutions api
  • Apply for Probate online Northern Ireland for DoJ (a massive project)
  • Pointer NI address lookup api
  • BCS time recording system
  • First provisional licence and renew bus / lorry applications on Dva online
  • Work on the Northern Ireland Driving Licence system

🚢 Future projects:

  • Adding machine learning projects using Tensor flow for image recognition
  • Online divorce NI
  • Redundancy payments service NI
  • Various redevelopments of old legacy systems
  • Chatbot technology

⚡ I am powered by:

  • Jimi Hendrix 🎸
  • Queens of the Stone Age
  • Dr. Pepper
  • Pizza 🍕
  • Kinder Buenos
  • Man City

⚡ Fun facts:

  • I am a juggler and can juggle fire! 🔥

🌱 I’m currently learning ...

  • Machine learning
  • AI
  • Monads

📫 How to reach me:

My Azure certifications

  • Azure Fundamentals
  • Azure Developer Associate
  • Azure DevOps Engineer Expert
  • Azure Administrator Associate
  • Azure AI Fundamentals
  • Azure AI Engineer Associate

If you like any of my work please add a star or buy me a coffee.

GitHub Streak

Code wars

nidirect-b2c-poc's People

Contributors

mend-bolt-for-github[bot] avatar michaelstevenson2207 avatar

Watchers

avatar

nidirect-b2c-poc's Issues

microsoft.identity.web.ui.1.25.1.nupkg: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - microsoft.identity.web.ui.1.25.1.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/5.0.0/system.drawing.common.5.0.0.nupkg

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (microsoft.identity.web.ui.1.25.1.nupkg version) Remediation Available
CVE-2021-24112 High 9.8 system.drawing.common.5.0.0.nupkg Transitive N/A* ❌
CVE-2022-34716 Medium 5.9 system.security.cryptography.xml.5.0.0.nupkg Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-24112

Vulnerable Library - system.drawing.common.5.0.0.nupkg

Provides access to GDI+ graphics functionality.

Commonly Used Types:
System.Drawing.Bitmap
System.D...

Library home page: https://api.nuget.org/packages/system.drawing.common.5.0.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/5.0.0/system.drawing.common.5.0.0.nupkg

Dependency Hierarchy:

  • microsoft.identity.web.ui.1.25.1.nupkg (Root Library)
    • microsoft.identity.web.1.25.1.nupkg
      • microsoft.identity.web.tokencache.1.25.1.nupkg
        • microsoft.aspnetcore.dataprotection.5.0.8.nupkg
          • system.security.cryptography.xml.5.0.0.nupkg
            • system.security.permissions.5.0.0.nupkg
              • system.windows.extensions.5.0.0.nupkg
                • ❌ system.drawing.common.5.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701.

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

CVE-2022-34716

Vulnerable Library - system.security.cryptography.xml.5.0.0.nupkg

Provides classes to support the creation and validation of XML digital signatures. The classes in th...

Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.5.0.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.xml/5.0.0/system.security.cryptography.xml.5.0.0.nupkg

Dependency Hierarchy:

  • microsoft.identity.web.ui.1.25.1.nupkg (Root Library)
    • microsoft.identity.web.1.25.1.nupkg
      • microsoft.identity.web.tokencache.1.25.1.nupkg
        • microsoft.aspnetcore.dataprotection.5.0.8.nupkg
          • ❌ system.security.cryptography.xml.5.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.7 or earlier.
  • Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

Publish Date: 2022-08-09

URL: CVE-2022-34716

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2m65-m22p-9wjw

Release Date: 2022-08-09

Fix Resolution: Microsoft.AspNetCore.App.Runtime.linux-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.osx-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x86 - 3.1.28,6.0.8;System.Security.Cryptography.Xml - 4.7.1,6.0.1

Step up your Open Source Security Game with Mend here

microsoft.azure.keyvault.3.0.5.nupkg: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - microsoft.azure.keyvault.3.0.5.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/10.0.3/newtonsoft.json.10.0.3.nupkg

Found in HEAD commit: 3eb64e1513155e7816dd28668b8d35e70722a3b1

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2019-0820 High 7.5 system.text.regularexpressions.4.3.0.nupkg Transitive N/A ❌
WS-2022-0161 High 7.5 newtonsoft.json.10.0.3.nupkg Transitive N/A ❌

Details

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.azure.keyvault.3.0.5.nupkg (Root Library)
    • microsoft.rest.clientruntime.azure.3.3.18.nupkg
      • microsoft.rest.clientruntime.2.3.20.nupkg
        • newtonsoft.json.10.0.3.nupkg
          • system.xml.xmldocument.4.3.0.nupkg
            • system.xml.readerwriter.4.3.0.nupkg
              • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3eb64e1513155e7816dd28668b8d35e70722a3b1

Found in base branch: master

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Step up your Open Source Security Game with Mend here

WS-2022-0161

Vulnerable Library - newtonsoft.json.10.0.3.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.10.0.3.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/10.0.3/newtonsoft.json.10.0.3.nupkg

Dependency Hierarchy:

  • microsoft.azure.keyvault.3.0.5.nupkg (Root Library)
    • microsoft.rest.clientruntime.azure.3.3.18.nupkg
      • microsoft.rest.clientruntime.2.3.20.nupkg
        • ❌ newtonsoft.json.10.0.3.nupkg (Vulnerable Library)

Found in HEAD commit: 3eb64e1513155e7816dd28668b8d35e70722a3b1

Found in base branch: master

Vulnerability Details

Improper Handling of Exceptional Conditions in Newtonsoft.Json.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed. Exploiting this vulnerability results in Denial Of Service (DoS), and it is exploitable when an attacker sends 5 requests that cause SOE in time frame of 5 minutes. This vulnerability affects Internet Information Services (IIS) Applications.

Publish Date: 2022-06-22

URL: WS-2022-0161

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: 2022-06-22

Fix Resolution: Newtonsoft.Json - 13.0.1;Microsoft.Extensions.ApiDescription.Server - 6.0.0

Step up your Open Source Security Game with Mend here

microsoft.azure.services.appauthentication.1.6.2.nupkg: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - microsoft.azure.services.appauthentication.1.6.2.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Found in HEAD commit: b764c523ef589265827248871a498463000404ae

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2019-0820 High 7.5 system.text.regularexpressions.4.3.0.nupkg Transitive N/A ❌

Details

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.azure.services.appauthentication.1.6.2.nupkg (Root Library)
    • microsoft.identitymodel.clients.activedirectory.5.2.9.nupkg
      • system.xml.xdocument.4.3.0.nupkg
        • system.xml.readerwriter.4.3.0.nupkg
          • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: b764c523ef589265827248871a498463000404ae

Found in base branch: master

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Step up your Open Source Security Game with Mend here

microsoft.identity.web.1.25.1.nupkg: 5 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - microsoft.identity.web.1.25.1.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.3.0/azure.identity.1.3.0.nupkg

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (microsoft.identity.web.1.25.1.nupkg version) Remediation Possible**
CVE-2021-24112 Critical 9.8 system.drawing.common.5.0.0.nupkg Transitive N/A* ❌
CVE-2023-36414 High 8.8 azure.identity.1.3.0.nupkg Transitive N/A* ❌
CVE-2022-34716 Medium 5.9 system.security.cryptography.xml.5.0.0.nupkg Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-24112

Vulnerable Library - system.drawing.common.5.0.0.nupkg

Provides access to GDI+ graphics functionality.

Commonly Used Types:
System.Drawing.Bitmap
System.D...

Library home page: https://api.nuget.org/packages/system.drawing.common.5.0.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/5.0.0/system.drawing.common.5.0.0.nupkg

Dependency Hierarchy:

  • microsoft.identity.web.1.25.1.nupkg (Root Library)
    • microsoft.identity.web.tokencache.1.25.1.nupkg
      • microsoft.aspnetcore.dataprotection.5.0.8.nupkg
        • system.security.cryptography.xml.5.0.0.nupkg
          • system.security.permissions.5.0.0.nupkg
            • system.windows.extensions.5.0.0.nupkg
              • ❌ system.drawing.common.5.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701.

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

CVE-2023-36414

Vulnerable Library - azure.identity.1.3.0.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.3.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.3.0/azure.identity.1.3.0.nupkg

Dependency Hierarchy:

  • microsoft.identity.web.1.25.1.nupkg (Root Library)
    • microsoft.identity.web.certificateless.1.25.1.nupkg
      • ❌ azure.identity.1.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity SDK Remote Code Execution Vulnerability

Publish Date: 2023-10-10

URL: CVE-2023-36414

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-36414

Release Date: 2023-10-10

Fix Resolution: Azure.Identity - 1.10.2

Step up your Open Source Security Game with Mend here

CVE-2022-34716

Vulnerable Library - system.security.cryptography.xml.5.0.0.nupkg

Provides classes to support the creation and validation of XML digital signatures. The classes in th...

Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.5.0.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.security.cryptography.xml/5.0.0/system.security.cryptography.xml.5.0.0.nupkg

Dependency Hierarchy:

  • microsoft.identity.web.1.25.1.nupkg (Root Library)
    • microsoft.identity.web.tokencache.1.25.1.nupkg
      • microsoft.aspnetcore.dataprotection.5.0.8.nupkg
        • ❌ system.security.cryptography.xml.5.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.7 or earlier.
  • Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

Publish Date: 2022-08-09

URL: CVE-2022-34716

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2m65-m22p-9wjw

Release Date: 2022-08-09

Fix Resolution: Microsoft.AspNetCore.App.Runtime.linux-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.osx-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x86 - 3.1.28,6.0.8;System.Security.Cryptography.Xml - 4.7.1,6.0.1

Step up your Open Source Security Game with Mend here

microsoft.extensions.configuration.azurekeyvault.3.1.24.nupkg: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - microsoft.extensions.configuration.azurekeyvault.3.1.24.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/9.0.1/newtonsoft.json.9.0.1.nupkg

Found in HEAD commit: 21975e785082de79b76f4a85dcee655c5f2eef23

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2019-0820 High 7.5 system.text.regularexpressions.4.3.0.nupkg Transitive N/A ❌
WS-2022-0161 High 7.5 newtonsoft.json.9.0.1.nupkg Transitive N/A ❌

Details

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.extensions.configuration.azurekeyvault.3.1.24.nupkg (Root Library)
    • microsoft.azure.keyvault.2.3.2.nupkg
      • microsoft.rest.clientruntime.azure.3.3.7.nupkg
        • microsoft.rest.clientruntime.2.3.8.nupkg
          • newtonsoft.json.9.0.1.nupkg
            • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 21975e785082de79b76f4a85dcee655c5f2eef23

Found in base branch: master

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Step up your Open Source Security Game with Mend here

WS-2022-0161

Vulnerable Library - newtonsoft.json.9.0.1.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.9.0.1.nupkg

Path to dependency file: /nidirect-B2c-poc.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/9.0.1/newtonsoft.json.9.0.1.nupkg

Dependency Hierarchy:

  • microsoft.extensions.configuration.azurekeyvault.3.1.24.nupkg (Root Library)
    • microsoft.azure.keyvault.2.3.2.nupkg
      • microsoft.rest.clientruntime.azure.3.3.7.nupkg
        • microsoft.rest.clientruntime.2.3.8.nupkg
          • ❌ newtonsoft.json.9.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 21975e785082de79b76f4a85dcee655c5f2eef23

Found in base branch: master

Vulnerability Details

Improper Handling of Exceptional Conditions in Newtonsoft.Json.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed. Exploiting this vulnerability results in Denial Of Service (DoS), and it is exploitable when an attacker sends 5 requests that cause SOE in time frame of 5 minutes. This vulnerability affects Internet Information Services (IIS) Applications.

Publish Date: 2022-06-22

URL: WS-2022-0161

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: 2022-06-22

Fix Resolution: Newtonsoft.Json - 13.0.1;Microsoft.Extensions.ApiDescription.Server - 6.0.0

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.