cube-soft / cube.net

CubeRSS Reader and network utilities for Cube projects

Cube.Net

Cube.Net is a network library. The repository also has some implemented applications based on the Cube.Net project. Libraries and applications are available for .NET Framework 3.5, 4.6, .NET Standard 2.0, .NET 6.0, or later.

CubeRSS Reader

CubeRSS Reader is an RSS/Atom feed reader that runs without receiving any assistance from servers for monitoring and crawling feeds.

You can get the executable installer from the download page (Japanese), or directly download link. We currently show menus and other messages only in Japanese, and support for other languages are one of our future works...

Contributing

1. Fork Cube.Net repository.
2. Create a feature branch from the master branch (e.g. git checkout -b my-new-feature origin/master). Note that the master branch may refer to some pre-release NuGet packages. Try the rake clobber and copy commands when build errors occur.
3. Commit your changes.
4. Rebase your local changes to the corresponding branch.
5. Run the dotnet test command or the Visual Studio and confirm that it passes.
6. Create new Pull Request.

License

Copyright © 2010 CubeSoft, Inc.

The project is licensed under the Apache 2.0. Note that trade names, trademarks, service marks, or logo images distributed in CubeSoft applications are not allowed to reuse or modify all or parts of them.

cube.net's Issues

CVE-2019-0981 (High) detected in system.private.uri.4.3.0.nupkg

CVE-2019-0981 - High Severity Vulnerability

Vulnerable Library - system.private.uri.4.3.0.nupkg

Internal implementation package not meant for direct consumption. Please do not reference directly....

Library home page: https://api.nuget.org/packages/system.private.uri.4.3.0.nupkg

Path to vulnerable library: /packages/system.private.uri/4.3.0/system.private.uri.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.private.uri.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.

Publish Date: 2019-05-16

URL: CVE-2019-0981

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981

Release Date: 2019-05-16

Fix Resolution: 4.3.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-0657 (Medium) detected in system.private.uri.4.3.0.nupkg

CVE-2019-0657 - Medium Severity Vulnerability

Vulnerable Library - system.private.uri.4.3.0.nupkg

Internal implementation package not meant for direct consumption. Please do not reference directly....

Library home page: https://api.nuget.org/packages/system.private.uri.4.3.0.nupkg

Path to vulnerable library: /packages/system.private.uri/4.3.0/system.private.uri.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.private.uri.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Publish Date: 2019-03-05

URL: CVE-2019-0657

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/dotnet/corefx/issues/35265

Release Date: 2018-11-26

Fix Resolution: Microsoft.NETCore.App.nupkg - 2.1.8,2.2.2;System.Private.Uri.nupkg - 4.3.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-0820 (High) detected in system.text.regularexpressions.4.1.0.nupkg

CVE-2019-0820 - High Severity Vulnerability

Vulnerable Library - system.text.regularexpressions.4.1.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.1.0.nupkg

Path to dependency file: Cube.Net/Tests/Core/Cube.Net.Tests.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.1.0/system.text.regularexpressions.4.1.0.nupkg

Dependency Hierarchy:

• microsoft.testplatform.testhost.17.0.0.nupkg (Root Library)
  • newtonsoft.json.9.0.1.nupkg
    • ❌ system.text.regularexpressions.4.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2020-08-24

Fix Resolution: System.Text.RegularExpressions - 4.3.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-0980 (High) detected in system.private.uri.4.3.0.nupkg

CVE-2019-0980 - High Severity Vulnerability

Vulnerable Library - system.private.uri.4.3.0.nupkg

Internal implementation package not meant for direct consumption. Please do not reference directly....

Library home page: https://api.nuget.org/packages/system.private.uri.4.3.0.nupkg

Path to vulnerable library: /packages/system.private.uri/4.3.0/system.private.uri.4.3.0.nupkg

Dependency Hierarchy:

• ❌ system.private.uri.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3b779dff33329123519e7803eacab63fe19606d1

Vulnerability Details

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0980

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980

Release Date: 2019-05-16

Fix Resolution: 4.3.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2018-1285 (Medium) detected in opencover.4.7.922.nupkg

CVE-2018-1285 - Medium Severity Vulnerability

Vulnerable Library - opencover.4.7.922.nupkg

An open source code coverage tool (branch and sequence point) for all .NET Frameworks 2 and above. A...

Library home page: https://api.nuget.org/packages/opencover.4.7.922.nupkg

Path to dependency file: /tmp/ws-scm/Cube.Net/Libraries/Tests/Cube.Net.Tests.csproj

Path to vulnerable library: /Cube.Net/Libraries/Tests/Cube.Net.Tests.csproj,/Cube.Net/Applications/Rss/Tests/Cube.Net.Rss.Tests.csproj

Dependency Hierarchy:

• ❌ opencover.4.7.922.nupkg (Vulnerable Library)

Found in HEAD commit: 4f39b4d65d4a8fa22353ba81f4ac1fd44113e3b4

Vulnerability Details

Apache log4net before 2.0.8 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.

Publish Date: 2020-05-11

URL: CVE-2018-1285

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/LOG4NET-575

Release Date: 2020-05-11

Fix Resolution: log4net - 2.1.0

---

Step up your Open Source Security Game with WhiteSource here

This is a test issue from WhiteSource, it will be closed shortly