Skip to content

Commit

Permalink
Explicitly depend on System.Formats.Asn1 8.0.1
Browse files Browse the repository at this point in the history 
Fixes a denial of service security vulnerability (CVE-2024-38095)
in the System.Security.Formats.Asn1 (<= 8.0.0) nuget package.
  • Loading branch information
@jstedfast
jstedfast committed Jul 11, 2024
1 parent 7c9d686 commit aef4eda
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 0 deletions.
1 change: 1 addition & 0 deletions MimeKit/MimeKit.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@

<ItemGroup Condition=" $(TargetFramework.StartsWith('netstandard2.')) Or $(TargetFramework.StartsWith('net6')) Or $(TargetFramework.StartsWith('net8')) ">
<PackageReference Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
<PackageReference Include="System.Formats.Asn1" Version="8.0.1" />

This comment has been minimized.

Sign in to view

Copy link
@emwl

emwl Jul 15, 2024

Just checking, but MailKit specifies this reference for .NET Framework 4 and .NET Standard 2 (but not for .NET 6 or .NET 8) while MimeKit does it for .NET Standard 2 and .NET 6/8 (but not .NET Framework 4.) Is this intentional, and if so, is it consistent?

One of my .NET Framework 4.8 projects raised MSB3277 as warning and picked the old version as best match due to being a primary reference (which I can address by explicitly using the package as well; except that I don't have any explicit references to System.Formats.Asn1 right now, so I'm curious where it came from originally.)

This comment has been minimized.

Sign in to view

Copy link
@jstedfast

jstedfast Jul 15, 2024

Author Owner

It comes from the System.Security.Cryptography.Pkcs package (which references Asn1 8.0.0)

This comment has been minimized.

Sign in to view

Copy link
@emwl

emwl Jul 15, 2024

Interresting, I don't use that package.

The question remains though, since MailKit references it on .NET Framework, but MimeKit doesn't.

Assembly Information

This comment has been minimized.

Sign in to view

Copy link
@jstedfast

jstedfast Jul 15, 2024

Author Owner

MimeKit depends on System.Security.Cryptography.Pkcs

This comment has been minimized.

Sign in to view

Copy link
@jstedfast

jstedfast Jul 15, 2024

Author Owner

MailKit also references Asn1. I forgot to fix MailKit's nuspec file to reference 8.0.1, so it was still referencing 8.0.0.

I've released MailKit 4.7.1.1 to fix this.

This comment has been minimized.

Sign in to view

Copy link
@emwl

emwl Jul 15, 2024

Yes, thats why I commented on here (since the references appear to be inconsistent; and I'm not sure if that was intentional or not)

This comment has been minimized.

Sign in to view

Copy link
@emwl

emwl Jul 16, 2024

I've released MailKit 4.7.1.1 to fix this.

That fixes it, thanks! 👍
</ItemGroup>

<ItemGroup Condition=" $(TargetFramework.StartsWith('netstandard2.')) ">
Expand Down
4 changes: 4 additions & 0 deletions nuget/MimeKit.nuspec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -80,15 +80,18 @@
</group>
<group targetFramework="net6.0">
<dependency id="System.Security.Cryptography.Pkcs" version="8.0.0" />
<dependency id="System.Formats.Asn1" version="8.0.1" />
<dependency id="BouncyCastle.Cryptography" version="2.4.0" />
</group>
<group targetFramework="net8.0">
<dependency id="System.Security.Cryptography.Pkcs" version="8.0.0" />
<dependency id="System.Formats.Asn1" version="8.0.1" />
<dependency id="BouncyCastle.Cryptography" version="2.4.0" />
</group>
<group targetFramework="netstandard2.0">
<dependency id="System.Runtime.CompilerServices.Unsafe" version="6.0.0" />
<dependency id="System.Security.Cryptography.Pkcs" version="8.0.0" />
<dependency id="System.Formats.Asn1" version="8.0.1" />
<dependency id="System.Text.Encoding.CodePages" version="8.0.0" />
<dependency id="System.Data.DataSetExtensions" version="4.5.0" />
<dependency id="System.Buffers" version="4.5.1" />
Expand All @@ -98,6 +101,7 @@
<group targetFramework="netstandard2.1">
<dependency id="System.Runtime.CompilerServices.Unsafe" version="6.0.0" />
<dependency id="System.Security.Cryptography.Pkcs" version="8.0.0" />
<dependency id="System.Formats.Asn1" version="8.0.1" />
<dependency id="System.Text.Encoding.CodePages" version="8.0.0" />
<dependency id="System.Buffers" version="4.5.1" />
<dependency id="System.Memory" version="4.5.5" />
Expand Down

0 comments on commit aef4eda

Please sign in to comment.