aivascu / wix.assemblyinfo

A WiX preprocessor extension for reading assembly info from compiled binaries.

Hello there!

I am Andrei Ivascu. 👋

I am a full-stack software engineer from Moldova 🇲🇩.

About me

• Software Development Lead at Key IVR
• Maintainer of AutoFixture
• I contribute to Open Source software
• I answer questions on Stack Overflow
• I like video games 🎮 and photography 📷

Stack Overflow

I monitor frequently the .NET realm of Stack Overflow. My main focus are the autofixture and unit-testing tags.

Stats

wix.assemblyinfo's Issues

WS-2016-0133 (Medium) detected in wix.3.9.2.nupkg

WS-2016-0133 - Medium Severity Vulnerability

Vulnerable Library - wix.3.9.2.nupkg

This package simply bundles the official binaries as a nuget, with all binaries under tools. This a...

Library home page: https://api.nuget.org/packages/wix.3.9.2.nupkg

Path to dependency file: /WiX.AssemblyInfo/src/Wix.AssemblyInfo.Tests/packages.config

Path to vulnerable library: /WiX.AssemblyInfo/src/Wix.AssemblyInfo.Tests/packages.config

Dependency Hierarchy:

• ❌ wix.3.9.2.nupkg (Vulnerable Library)

Found in HEAD commit: 082d1ef4c09de790ea4134556ca210d304660ebd

Vulnerability Details

DLL hijacking vulnerability in WiX.Toolset.UnofficialFork before 3.10.2.

Publish Date: 2016-02-08

URL: WS-2016-0133

CVSS 2 Score Details (5.9)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.firegiant.com/blog/2016/1/20/wix-v3.10.2-released/

Release Date: 2017-01-31

Fix Resolution: 3.10.2

---

Step up your Open Source Security Game with WhiteSource here