Skip to content
Fencer Intel
low —

GHSA-g4vj-cjjj-v7hg json

Defense in Depth update for NuGet Client

published 7mo ago modified 2mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version| |--|--| |>= 4.9.0, <= 4.9.6|4.9.7| |>= 5.11.0, <= 5.11.6|5.11.7| |>= 6.8.0, <= 6.8.1|6.8.2| |>= 6.11.0, <= 6.11.1|6.11.2| |>= 6.12.0, <= 6.12.4|6.12.5| |>= 6.14.0, <= 6.14.2|6.14.3| |>= 7.0.0, <= 7.0.2|7.0.3| |7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK * .NET 8.0.420 SDK * .NET 9.0.116 SDK * .NET 9.0.313 SDK * .NET 10.0.106 SDK * .NET 10.0.202 SDK

### Workarounds N/A

### References https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit [splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)

Patch / fix

  • nuget NuGet.Packaging 4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
  • nuget NuGet.Protocol 4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
  • nuget NuGet.CommandLine 4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1

Is GHSA-g4vj-cjjj-v7hg in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
nuget NuGet.Packaging
>=4.9.0, <4.9.7
>=5.11.0, <5.11.7
>=6.8.0, <6.8.2
>=6.11.0, <6.11.2
>=6.12.0, <6.12.5
>=6.14.0, <6.14.3
>=7.0.0, <7.0.3
>=7.3.0, <7.3.1
4.9.7
5.11.7
6.8.2
6.11.2
6.12.5
6.14.3
7.0.3
7.3.1
nuget NuGet.Protocol
>=4.9.0, <4.9.7
>=5.11.0, <5.11.7
>=6.8.0, <6.8.2
>=6.11.0, <6.11.2
>=6.12.0, <6.12.5
>=6.14.0, <6.14.3
>=7.0.0, <7.0.3
>=7.3.0, <7.3.1
4.9.7
5.11.7
6.8.2
6.11.2
6.12.5
6.14.3
7.0.3
7.3.1
nuget NuGet.CommandLine
>=4.9.0, <4.9.7
>=5.11.0, <5.11.7
>=6.8.0, <6.8.2
>=6.11.0, <6.11.2
>=6.12.0, <6.12.5
>=6.14.0, <6.14.3
>=7.0.0, <7.0.3
>=7.3.0, <7.3.1
4.9.7
5.11.7
6.8.2
6.11.2
6.12.5
6.14.3
7.0.3
7.3.1

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.