Coder Social home page Coder Social logo

confluent-kafka-dotnet-721's Introduction

Confluent's .NET Client for Apache KafkaTM

Travis Build Status Build status Chat on Slack

confluent-kafka-dotnet is Confluent's .NET client for Apache Kafka and the Confluent Platform.

Features:

  • High performance - confluent-kafka-dotnet is a lightweight wrapper around librdkafka, a finely tuned C client.

  • Reliability - There are a lot of details to get right when writing an Apache Kafka client. We get them right in one place (librdkafka) and leverage this work across all of our clients (also confluent-kafka-python and confluent-kafka-go).

  • Supported - Commercial support is offered by Confluent.

  • Future proof - Confluent, founded by the creators of Kafka, is building a streaming platform with Apache Kafka at its core. It's high priority for us that client features keep pace with core Apache Kafka and components of the Confluent Platform.

confluent-kafka-dotnet is derived from Andreas Heider's rdkafka-dotnet. We're fans of his work and were very happy to have been able to leverage rdkafka-dotnet as the basis of this client. Thanks Andreas!

Referencing

confluent-kafka-dotnet is distributed via NuGet. We provide five packages:

  • Confluent.Kafka [net45, netstandard1.3, netstandard2.0] - The core client library.
  • Confluent.SchemaRegistry.Serdes.Avro [netstandard2.0] - Provides a serializer and deserializer for working with Avro serialized data with Confluent Schema Registry integration.
  • Confluent.SchemaRegistry.Serdes.Protobuf [netstandard2.0] - Provides a serializer and deserializer for working with Protobuf serialized data with Confluent Schema Registry integration.
  • Confluent.SchemaRegistry.Serdes.Json [netstandard2.0] - Provides a serializer and deserializer for working with Json serialized data with Confluent Schema Registry integration.
  • Confluent.SchemaRegistry [netstandard1.4, netstandard2.0] - Confluent Schema Registry client (a dependency of the Confluent.SchemaRegistry.Serdes packages).

To install Confluent.Kafka from within Visual Studio, search for Confluent.Kafka in the NuGet Package Manager UI, or run the following command in the Package Manager Console:

Install-Package Confluent.Kafka -Version 1.5.3

To add a reference to a dotnet core project, execute the following at the command line:

dotnet add package -v 1.5.3 Confluent.Kafka

Note: Confluent.Kafka depends on the librdkafka.redist package which provides a number of different builds of librdkafka that are compatible with common platforms. If you are on one of these platforms this will all work seamlessly (and you don't need to explicitly reference librdkafka.redist). If you are on a different platform, you may need to build librdkafka manually (or acquire it via other means) and load it using the Library.Load method.

Branch builds

Nuget packages corresponding to all commits to release branches are available from the following nuget package source (Note: this is not a web URL - you should specify it in the nuget package manger): https://ci.appveyor.com/nuget/confluent-kafka-dotnet. The version suffix of these nuget packages matches the appveyor build number. You can see which commit a particular build number corresponds to by looking at the AppVeyor build history

Usage

Take a look in the examples directory for example usage. The integration tests also serve as good examples.

For an overview of configuration properties, refer to the librdkafka documentation.

Basic Producer Examples

You should use the ProduceAsync method if you would like to wait for the result of your produce requests before proceeding. You might typically want to do this in highly concurrent scenarios, for example in the context of handling web requests. Behind the scenes, the client will manage optimizing communication with the Kafka brokers for you, batching requests as appropriate.

using System;
using System.Threading.Tasks;
using Confluent.Kafka;

class Program
{
    public static async Task Main(string[] args)
    {
        var config = new ProducerConfig { BootstrapServers = "localhost:9092" };

        // If serializers are not specified, default serializers from
        // `Confluent.Kafka.Serializers` will be automatically used where
        // available. Note: by default strings are encoded as UTF8.
        using (var p = new ProducerBuilder<Null, string>(config).Build())
        {
            try
            {
                var dr = await p.ProduceAsync("test-topic", new Message<Null, string> { Value="test" });
                Console.WriteLine($"Delivered '{dr.Value}' to '{dr.TopicPartitionOffset}'");
            }
            catch (ProduceException<Null, string> e)
            {
                Console.WriteLine($"Delivery failed: {e.Error.Reason}");
            }
        }
    }
}

Note that a server round-trip is slow (3ms at a minimum; actual latency depends on many factors). In highly concurrent scenarios you will achieve high overall throughput out of the producer using the above approach, but there will be a delay on each await call. In stream processing applications, where you would like to process many messages in rapid succession, you would typically use the Produce method instead:

using System;
using Confluent.Kafka;

class Program
{
    public static void Main(string[] args)
    {
        var conf = new ProducerConfig { BootstrapServers = "localhost:9092" };

        Action<DeliveryReport<Null, string>> handler = r => 
            Console.WriteLine(!r.Error.IsError
                ? $"Delivered message to {r.TopicPartitionOffset}"
                : $"Delivery Error: {r.Error.Reason}");

        using (var p = new ProducerBuilder<Null, string>(conf).Build())
        {
            for (int i=0; i<100; ++i)
            {
                p.Produce("my-topic", new Message<Null, string> { Value = i.ToString() }, handler);
            }

            // wait for up to 10 seconds for any inflight messages to be delivered.
            p.Flush(TimeSpan.FromSeconds(10));
        }
    }
}

Basic Consumer Example

using System;
using System.Threading;
using Confluent.Kafka;

class Program
{
    public static void Main(string[] args)
    {
        var conf = new ConsumerConfig
        { 
            GroupId = "test-consumer-group",
            BootstrapServers = "localhost:9092",
            // Note: The AutoOffsetReset property determines the start offset in the event
            // there are not yet any committed offsets for the consumer group for the
            // topic/partitions of interest. By default, offsets are committed
            // automatically, so in this example, consumption will only start from the
            // earliest message in the topic 'my-topic' the first time you run the program.
            AutoOffsetReset = AutoOffsetReset.Earliest
        };

        using (var c = new ConsumerBuilder<Ignore, string>(conf).Build())
        {
            c.Subscribe("my-topic");

            CancellationTokenSource cts = new CancellationTokenSource();
            Console.CancelKeyPress += (_, e) => {
                e.Cancel = true; // prevent the process from terminating.
                cts.Cancel();
            };

            try
            {
                while (true)
                {
                    try
                    {
                        var cr = c.Consume(cts.Token);
                        Console.WriteLine($"Consumed message '{cr.Value}' at: '{cr.TopicPartitionOffset}'.");
                    }
                    catch (ConsumeException e)
                    {
                        Console.WriteLine($"Error occured: {e.Error.Reason}");
                    }
                }
            }
            catch (OperationCanceledException)
            {
                // Ensure the consumer leaves the group cleanly and final offsets are committed.
                c.Close();
            }
        }
    }
}

IHostedService and Web Application Integration

The Web example demonstrates how to integrate Apache Kafka with a web application, including how to implement IHostedService to realize a long running consumer poll loop, how to register a producer as a singleton service, and how to bind configuration from an injected IConfiguration instance.

Schema Registry Integration

The three "Serdes" packages provide serializers and deserializers for Avro, Protobuf and JSON with Confluent Schema Registry integration. The Confluent.SchemaRegistry nuget package provides a client for interfacing with Schema Registry's REST API.

Note: All three serialization formats are supported across Confluent Platform. They each make different tradeoffs, and you should use the one that best matches to your requirements. Avro is well suited to the streaming data use-case, but the maturity of the non-Java implementations lags that of Java - this is an important consideration. Protobuf and JSON both have great support in .NET.

Avro

You can use the Avro serializer and deserializer with the GenericRecord class or with specific classes generated using the avrogen tool, available via Nuget (.NET Core 2.1 required):

dotnet tool install --global Apache.Avro.Tools

Usage:

avrogen -s your_schema.avsc .

For more information about working with Avro in .NET, refer to the the blog post Decoupling Systems with Apache Kafka, Schema Registry and Avro

Error Handling

Errors delivered to a client's error handler should be considered informational except when the IsFatal flag is set to true, indicating that the client is in an un-recoverable state. Currently, this can only happen on the producer, and only when enable.idempotence has been set to true. In all other scenarios, clients will attempt to recover from all errors automatically.

Although calling most methods on the clients will result in a fatal error if the client is in an un-recoverable state, you should generally only need to explicitly check for fatal errors in your error handler, and handle this scenario there.

Producer

When using Produce, to determine whether a particular message has been successfully delivered to a cluster, check the Error field of the DeliveryReport during the delivery handler callback.

When using ProduceAsync, any delivery result other than NoError will cause the returned Task to be in the faulted state, with the Task.Exception field set to a ProduceException containing information about the message and error via the DeliveryResult and Error fields. Note: if you await the call, this means a ProduceException will be thrown.

Consumer

All Consume errors will result in a ConsumeException with further information about the error and context available via the Error and ConsumeResult fields.

Confluent Cloud

The Confluent Cloud example demonstrates how to configure the .NET client for use with Confluent Cloud.

Developer Notes

Instructions on building and testing confluent-kafka-dotnet can be found here.

Copyright (c) 2016-2019 Confluent Inc. 2015-2016 Andreas Heider

confluent-kafka-dotnet-721's People

Contributors

feemstr avatar hugh-mend avatar mend-for-github-com[bot] avatar

Watchers

 avatar

confluent-kafka-dotnet-721's Issues

newtonsoft.json.9.0.1.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - newtonsoft.json.9.0.1.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.9.0.1.nupkg

Path to dependency file: /src/Confluent.SchemaRegistry.Serdes.Json/Confluent.SchemaRegistry.Serdes.Json.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/9.0.1/newtonsoft.json.9.0.1.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (newtonsoft.json.9.0.1.nupkg version) Remediation Possible** Reachability
CVE-2024-21907 High 7.5 Not Defined 0.3% newtonsoft.json.9.0.1.nupkg Direct Newtonsoft.Json - 13.0.1

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21907

Vulnerable Library - newtonsoft.json.9.0.1.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.9.0.1.nupkg

Path to dependency file: /src/Confluent.SchemaRegistry.Serdes.Json/Confluent.SchemaRegistry.Serdes.Json.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/9.0.1/newtonsoft.json.9.0.1.nupkg

Dependency Hierarchy:

  • newtonsoft.json.9.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Publish Date: 2024-01-03

URL: CVE-2024-21907

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: 2024-01-03

Fix Resolution: Newtonsoft.Json - 13.0.1

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

apache.avro.1.10.1.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - apache.avro.1.10.1.nupkg

Avro provides:

  Rich data structures.
  A compact, fast, binary data format.
  A conta...</p>

Library home page: https://api.nuget.org/packages/apache.avro.1.10.1.nupkg

Path to dependency file: /examples/AvroSpecific/AvroSpecific.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/apache.avro/1.10.1/apache.avro.1.10.1.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (apache.avro.1.10.1.nupkg version) Remediation Possible** Reachability
CVE-2021-43045 High 7.5 Not Defined 0.1% apache.avro.1.10.1.nupkg Direct Apache.Avro - 1.11.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-43045

Vulnerable Library - apache.avro.1.10.1.nupkg

Avro provides:

  Rich data structures.
  A compact, fast, binary data format.
  A conta...</p>

Library home page: https://api.nuget.org/packages/apache.avro.1.10.1.nupkg

Path to dependency file: /examples/AvroSpecific/AvroSpecific.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/apache.avro/1.10.1/apache.avro.1.10.1.nupkg

Dependency Hierarchy:

  • apache.avro.1.10.1.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.

Publish Date: 2022-01-06

URL: CVE-2021-43045

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43045

Release Date: 2022-01-06

Fix Resolution: Apache.Avro - 1.11.0

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

microsoft.netcore.app.2.1.0.nupkg: 9 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (microsoft.netcore.app.2.1.0.nupkg version) Remediation Possible** Reachability
CVE-2019-1302 High 8.8 Not Defined 0.2% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.AspNetCore.SpaServices - 2.2.1,2.1.2
CVE-2020-1147 High 7.8 High 86.2% microsoft.netcore.app.2.1.0.nupkg Direct microsoft.aspnetcore.all - 2.1.20;microsoft.netcore.app - 2.1.20;microsoft.aspnetcore.app - 2.1.20
CVE-2020-1108 High 7.5 Not Defined 0.1% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.NETCore.App - 2.1.18, Microsoft.NETCore.App.Runtime - 3.1.4
CVE-2020-1045 High 7.5 Proof of concept 0.4% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.AspNetCore.App - 2.1.22, Microsoft.AspNetCore.All - 2.1.22,Microsoft.NETCore.App - 2.1.22, Microsoft.AspNetCore.Http - 2.1.22
CVE-2019-0564 High 7.5 Not Defined 0.3% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.AspNetCore.WebSockets - 2.1.7,2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7;System.Net.WebSockets.WebSocketProtocol - 4.5.3;Microsoft.NETCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.All - 2.1.7,2.2.1
CVE-2019-0545 High 7.5 Not Defined 2.0% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.NETCore.App - 2.1.7,2.2.1
CVE-2018-8416 Medium 6.5 Not Defined 0.1% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.NETCore.App - 2.1.7
CVE-2019-0657 Medium 5.9 Not Defined 0.2% microsoft.netcore.app.2.1.0.nupkg Direct Microsoft.NETCore.App.nupkg - 2.1.8,2.2.2;System.Private.Uri.nupkg - 4.3.1
CVE-2019-0548 Medium 5.3 Not Defined 0.3% detected in multiple dependencies Direct Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets - 2.2.1; Microsoft.AspNetCore.Server.IIS - 2.2.1; Microsoft.AspNetCore.Server.IISIntegration - 2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-1302

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

Publish Date: 2019-09-11

URL: CVE-2019-1302

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-09-11

Fix Resolution: Microsoft.AspNetCore.SpaServices - 2.2.1,2.1.2

In order to enable automatic remediation, please create workflow rules

CVE-2020-1147

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Publish Date: 2020-07-14

URL: CVE-2020-1147

Threat Assessment

Exploit Maturity: High

EPSS: 86.2%

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-14

Fix Resolution: microsoft.aspnetcore.all - 2.1.20;microsoft.netcore.app - 2.1.20;microsoft.aspnetcore.app - 2.1.20

In order to enable automatic remediation, please create workflow rules

CVE-2020-1108

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.

Publish Date: 2020-05-21

URL: CVE-2020-1108

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3w5p-jhp5-c29q

Release Date: 2020-05-21

Fix Resolution: Microsoft.NETCore.App - 2.1.18, Microsoft.NETCore.App.Runtime - 3.1.4

In order to enable automatic remediation, please create workflow rules

CVE-2020-1045

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.

The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.

The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.

Publish Date: 2020-09-11

URL: CVE-2020-1045

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 0.4%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-11

Fix Resolution: Microsoft.AspNetCore.App - 2.1.22, Microsoft.AspNetCore.All - 2.1.22,Microsoft.NETCore.App - 2.1.22, Microsoft.AspNetCore.Http - 2.1.22

In order to enable automatic remediation, please create workflow rules

CVE-2019-0564

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

Publish Date: 2019-01-08

URL: CVE-2019-0564

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-08

Fix Resolution: Microsoft.AspNetCore.WebSockets - 2.1.7,2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7;System.Net.WebSockets.WebSocketProtocol - 4.5.3;Microsoft.NETCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.All - 2.1.7,2.2.1

In order to enable automatic remediation, please create workflow rules

CVE-2019-0545

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.

Publish Date: 2019-01-08

URL: CVE-2019-0545

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 2.0%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-14

Fix Resolution: Microsoft.NETCore.App - 2.1.7,2.2.1

In order to enable automatic remediation, please create workflow rules

CVE-2018-8416

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Publish Date: 2018-11-14

URL: CVE-2018-8416

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-11-14

Fix Resolution: Microsoft.NETCore.App - 2.1.7

In order to enable automatic remediation, please create workflow rules

CVE-2019-0657

Vulnerable Library - microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

Publish Date: 2019-03-06

URL: CVE-2019-0657

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-03-07

Fix Resolution: Microsoft.NETCore.App.nupkg - 2.1.8,2.2.2;System.Private.Uri.nupkg - 4.3.1

In order to enable automatic remediation, please create workflow rules

CVE-2019-0548

Vulnerable Libraries - microsoft.netcore.app.2.1.0.nupkg, microsoft.netcore.dotnetapphost.2.1.0.nupkg, microsoft.netcore.dotnethostpolicy.2.1.0.nupkg, microsoft.netcore.dotnethostresolver.2.1.0.nupkg

microsoft.netcore.app.2.1.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. caa7b7e2bad98e56a687fb5cbaf60825500800f7 When using NuGet 3.x this package requires at least version 3.4.

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Vulnerable Library)

microsoft.netcore.dotnetapphost.2.1.0.nupkg

Provides the .NET Core app bootstrapper intended for use in the application directory caa7b7e2bad98...

Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnetapphost.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnetapphost/2.1.0/microsoft.netcore.dotnetapphost.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Root Library)
    • microsoft.netcore.dotnethostpolicy.2.1.0.nupkg
      • microsoft.netcore.dotnethostresolver.2.1.0.nupkg
        • microsoft.netcore.dotnetapphost.2.1.0.nupkg (Vulnerable Library)

microsoft.netcore.dotnethostpolicy.2.1.0.nupkg

Provides a CoreCLR hosting policy implementation -- configuration settings, assembly paths and assem...

Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnethostpolicy.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnethostpolicy/2.1.0/microsoft.netcore.dotnethostpolicy.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Root Library)
    • microsoft.netcore.dotnethostpolicy.2.1.0.nupkg (Vulnerable Library)

microsoft.netcore.dotnethostresolver.2.1.0.nupkg

Provides an implementation of framework resolution strategy used by Microsoft.NETCore.DotNetHost ca...

Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnethostresolver.2.1.0.nupkg

Path to dependency file: /examples/Consumer/Consumer.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnethostresolver/2.1.0/microsoft.netcore.dotnethostresolver.2.1.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.1.0.nupkg (Root Library)
    • microsoft.netcore.dotnethostpolicy.2.1.0.nupkg
      • microsoft.netcore.dotnethostresolver.2.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.

Publish Date: 2019-01-08

URL: CVE-2019-0548

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-08

Fix Resolution: Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets - 2.2.1; Microsoft.AspNetCore.Server.IIS - 2.2.1; Microsoft.AspNetCore.Server.IISIntegration - 2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

  • [NEUTRAL] Update dependency System.Console to v4.3.1
  • [NEUTRAL] Update dependency System.Memory to v4.5.5
  • [NEUTRAL] Update dependency System.Runtime.Extensions to v4.3.1
  • [LOW] Update dependency Apache.Avro to v1.12.0
  • [NEUTRAL] Update dependency Google.Protobuf to v3.28.1
  • [NEUTRAL] Update dependency librdkafka.redist to v1.9.2
  • [LOW] Update dependency NJsonSchema to v11
  • [NEUTRAL] Update dependency librdkafka.redist to v2
  • 🔐 Create all pending approval PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

nuget
src/ConfigGen/ConfigGen.csproj
  • System.Net.Http 4.3.3
src/Confluent.Kafka/Confluent.Kafka.csproj
  • System.Threading 4.3.0
  • System.Runtime.Extensions 4.3.0
  • System.Runtime.InteropServices 4.3.0
  • System.Linq 4.3.0
  • System.Console 4.3.0
  • System.Memory 4.5.0
  • librdkafka.redist 1.5.3
src/Confluent.SchemaRegistry.Serdes.Avro/Confluent.SchemaRegistry.Serdes.Avro.csproj
  • System.Net.NameResolution 4.3.0
  • System.Net.Sockets 4.3.0
  • Apache.Avro 1.10.1
src/Confluent.SchemaRegistry.Serdes.Json/Confluent.SchemaRegistry.Serdes.Json.csproj
  • System.Net.NameResolution 4.3.0
  • System.Net.Sockets 4.3.0
  • NJsonSchema 10.1.5
src/Confluent.SchemaRegistry.Serdes.Protobuf/Confluent.SchemaRegistry.Serdes.Protobuf.csproj
  • System.Net.NameResolution 4.3.0
  • System.Net.Sockets 4.3.0
  • Google.Protobuf 3.11.2
src/Confluent.SchemaRegistry/Confluent.SchemaRegistry.csproj
  • System.Net.Http 4.3.0
  • Newtonsoft.Json 9.0.1

google.protobuf.3.11.2.nupkg: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - google.protobuf.3.11.2.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.11.2.nupkg

Path to dependency file: /test/Confluent.SchemaRegistry.Serdes.IntegrationTests/Confluent.SchemaRegistry.Serdes.IntegrationTests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.11.2/google.protobuf.3.11.2.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (google.protobuf.3.11.2.nupkg version) Remediation Possible** Reachability
CVE-2021-22570 Medium 6.5 Not Defined 0.0% google.protobuf.3.11.2.nupkg Direct Google.Protobuf - 3.15.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-22570

Vulnerable Library - google.protobuf.3.11.2.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.11.2.nupkg

Path to dependency file: /test/Confluent.SchemaRegistry.Serdes.IntegrationTests/Confluent.SchemaRegistry.Serdes.IntegrationTests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.11.2/google.protobuf.3.11.2.nupkg

Dependency Hierarchy:

  • google.protobuf.3.11.2.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Publish Date: 2022-01-26

URL: CVE-2021-22570

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-77rm-9x9h-xj3g

Release Date: 2022-01-26

Fix Resolution: Google.Protobuf - 3.15.0

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

google.protobuf.3.11.3.nupkg: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - google.protobuf.3.11.3.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.11.3.nupkg

Path to dependency file: /test/Confluent.SchemaRegistry.Serdes.UnitTests/Confluent.SchemaRegistry.Serdes.UnitTests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.11.3/google.protobuf.3.11.3.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (google.protobuf.3.11.3.nupkg version) Remediation Possible** Reachability
CVE-2021-22570 Medium 6.5 Not Defined 0.0% google.protobuf.3.11.3.nupkg Direct Google.Protobuf - 3.15.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-22570

Vulnerable Library - google.protobuf.3.11.3.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.11.3.nupkg

Path to dependency file: /test/Confluent.SchemaRegistry.Serdes.UnitTests/Confluent.SchemaRegistry.Serdes.UnitTests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.11.3/google.protobuf.3.11.3.nupkg

Dependency Hierarchy:

  • google.protobuf.3.11.3.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Publish Date: 2022-01-26

URL: CVE-2021-22570

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-77rm-9x9h-xj3g

Release Date: 2022-01-26

Fix Resolution: Google.Protobuf - 3.15.0

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

moq.4.7.99.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - moq.4.7.99.nupkg

Path to dependency file: /test/Confluent.SchemaRegistry.Serdes.UnitTests/Confluent.SchemaRegistry.Serdes.UnitTests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (moq.4.7.99.nupkg version) Remediation Possible** Reachability
CVE-2019-0820 High 7.5 Not Defined 0.2% system.text.regularexpressions.4.3.0.nupkg Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/Confluent.SchemaRegistry/Confluent.SchemaRegistry.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • moq.4.7.99.nupkg (Root Library)
    • castle.core.4.1.1.nupkg
      • system.xml.xmldocument.4.3.0.nupkg
        • system.xml.readerwriter.4.3.0.nupkg
          • system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

system.net.http.4.3.3.nupkg: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - system.net.http.4.3.3.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.3.nupkg

Path to dependency file: /src/ConfigGen/ConfigGen.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.3/system.net.http.4.3.3.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (system.net.http.4.3.3.nupkg version) Remediation Possible** Reachability
CVE-2018-8292 Medium 5.3 Not Defined 2.2% system.net.http.4.3.3.nupkg Direct System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.3.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.3.nupkg

Path to dependency file: /src/ConfigGen/ConfigGen.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.3/system.net.http.4.3.3.nupkg

Dependency Hierarchy:

  • system.net.http.4.3.3.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 2.2%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

system.net.http.4.3.0.nupkg: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Confluent.SchemaRegistry.Serdes.Json/Confluent.SchemaRegistry.Serdes.Json.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (system.net.http.4.3.0.nupkg version) Remediation Possible** Reachability
CVE-2018-8292 Medium 5.3 Not Defined 2.2% system.net.http.4.3.0.nupkg Direct System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Confluent.SchemaRegistry.Serdes.Json/Confluent.SchemaRegistry.Serdes.Json.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 2.2%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

newtonsoft.json.10.0.3.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - newtonsoft.json.10.0.3.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.10.0.3.nupkg

Path to dependency file: /examples/AvroSpecific/AvroSpecific.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/10.0.3/newtonsoft.json.10.0.3.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (newtonsoft.json.10.0.3.nupkg version) Remediation Possible** Reachability
CVE-2024-21907 High 7.5 Not Defined 0.3% newtonsoft.json.10.0.3.nupkg Direct Newtonsoft.Json - 13.0.1

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21907

Vulnerable Library - newtonsoft.json.10.0.3.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.10.0.3.nupkg

Path to dependency file: /examples/AvroSpecific/AvroSpecific.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/10.0.3/newtonsoft.json.10.0.3.nupkg

Dependency Hierarchy:

  • newtonsoft.json.10.0.3.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Publish Date: 2024-01-03

URL: CVE-2024-21907

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: 2024-01-03

Fix Resolution: Newtonsoft.Json - 13.0.1

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

xunit.runner.visualstudio.2.4.1.nupkg: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - xunit.runner.visualstudio.2.4.1.nupkg

Path to dependency file: /test/Confluent.Kafka.IntegrationTests/Confluent.Kafka.IntegrationTests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.1.0/system.text.regularexpressions.4.1.0.nupkg

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (xunit.runner.visualstudio.2.4.1.nupkg version) Remediation Available
CVE-2019-0820 High 7.5 system.text.regularexpressions.4.1.0.nupkg Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.1.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.1.0.nupkg

Path to dependency file: /src/Confluent.SchemaRegistry.Serdes.Json/Confluent.SchemaRegistry.Serdes.Json.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.1.0/system.text.regularexpressions.4.1.0.nupkg

Dependency Hierarchy:

  • xunit.runner.visualstudio.2.4.1.nupkg (Root Library)
    • microsoft.net.test.sdk.15.5.0.nupkg
      • microsoft.testplatform.testhost.15.5.0.nupkg
        • microsoft.testplatform.objectmodel.15.5.0.nupkg
          • system.xml.xpath.xmldocument.4.0.1.nupkg
            • system.xml.xmldocument.4.0.1.nupkg
              • system.xml.readerwriter.4.0.11.nupkg
                • system.text.regularexpressions.4.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: ff2df9cdf68ec852d156a82c43c9cae264cc54b0

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Code Security Report: 6 total findings

Code Security Report

Scan Metadata

Latest Scan: 2024-07-31 08:23pm
Total Findings: 6 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 224
Detected Programming Languages: 1 (C#*)

  • Check this box to manually trigger a scan

Finding Details

SeverityVulnerability TypeCWEFileData FlowsDate
MediumHardcoded Password/Credentials

CWE-798

RestService.cs:59

22024-07-31 08:23pm
Vulnerable Code

? new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{username}:{password}")))

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Hardcoded Password/Credentials Training

● Videos

   ▪ Secure Code Warrior Hardcoded Password/Credentials Video

● Further Reading

   ▪ OWASP Top Ten 2017 A3: Sensitive Data Exposure

   ▪ OWASP Top Ten Proactive Controls 2018 C8: Protect Data Everywhere

   ▪ OWASP Top Ten 2021 A02: Cryptographic Failures

 
MediumHardcoded Password/Credentials

CWE-798

CachedSchemaRegistryClient.cs:265

12024-07-31 08:23pm
Vulnerable Code

                certificates.Add(new X509Certificate2(certificateLocation, certificatePassword));

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Hardcoded Password/Credentials Training

● Videos

   ▪ Secure Code Warrior Hardcoded Password/Credentials Video

● Further Reading

   ▪ OWASP Top Ten 2017 A3: Sensitive Data Exposure

   ▪ OWASP Top Ten Proactive Controls 2018 C8: Protect Data Everywhere

   ▪ OWASP Top Ten 2021 A02: Cryptographic Failures

 
MediumHardcoded Password/Credentials

CWE-798

Program.cs:70

12024-07-31 08:23pm
Vulnerable Code

SaslPassword = "<confluent cloud secret>",

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Hardcoded Password/Credentials Training

● Videos

   ▪ Secure Code Warrior Hardcoded Password/Credentials Video

● Further Reading

   ▪ OWASP Top Ten 2017 A3: Sensitive Data Exposure

   ▪ OWASP Top Ten Proactive Controls 2018 C8: Protect Data Everywhere

   ▪ OWASP Top Ten 2021 A02: Cryptographic Failures

 
MediumHardcoded Password/Credentials

CWE-798

Program.cs:69

12024-07-31 08:23pm
Vulnerable Code

SaslUsername = "<confluent cloud key>",

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Hardcoded Password/Credentials Training

● Videos

   ▪ Secure Code Warrior Hardcoded Password/Credentials Video

● Further Reading

   ▪ OWASP Top Ten 2017 A3: Sensitive Data Exposure

   ▪ OWASP Top Ten Proactive Controls 2018 C8: Protect Data Everywhere

   ▪ OWASP Top Ten 2021 A02: Cryptographic Failures

 
MediumHardcoded Password/Credentials

CWE-798

Program.cs:49

12024-07-31 08:23pm
Vulnerable Code

SaslPassword = "<ccloud secret>"

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Hardcoded Password/Credentials Training

● Videos

   ▪ Secure Code Warrior Hardcoded Password/Credentials Video

● Further Reading

   ▪ OWASP Top Ten 2017 A3: Sensitive Data Exposure

   ▪ OWASP Top Ten Proactive Controls 2018 C8: Protect Data Everywhere

   ▪ OWASP Top Ten 2021 A02: Cryptographic Failures

 
MediumHardcoded Password/Credentials

CWE-798

Program.cs:48

12024-07-31 08:23pm
Vulnerable Code

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Hardcoded Password/Credentials Training

● Videos

   ▪ Secure Code Warrior Hardcoded Password/Credentials Video

● Further Reading

   ▪ OWASP Top Ten 2017 A3: Sensitive Data Exposure

   ▪ OWASP Top Ten Proactive Controls 2018 C8: Protect Data Everywhere

   ▪ OWASP Top Ten 2021 A02: Cryptographic Failures

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.