microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg: 5 vulnerabilities (highest severity is: 7.5) reachable

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg</summary>


Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.extensions.caching.memory/8.0.0/microsoft.extensions.caching.memory.8.0.0.nupkg



Found in HEAD commit: <a href="https://github.com/Vonage/vonage-dotnet-code-snippets/commit/3edaf92a0a3aa3d7441e08d996d889594d4650f6">3edaf92a0a3aa3d7441e08d996d889594d4650f6</a></details>

## Vulnerabilities

| CVE | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg version) | Remediation Possible** | Reachability |
| ------------- | ------------- | ----- | ----- | ----- | ----- | ----- | ------------- | --- | --- |
| [CVE-2024-43485](https://www.mend.io/vulnerability-database/CVE-2024-43485) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Unproven | 3.4% | system.text.json.8.0.4.nupkg | Transitive | N/A* | &#10060;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> Reachable |
| [CVE-2024-43483](https://www.mend.io/vulnerability-database/CVE-2024-43483) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Unproven | 11.900001% | microsoft.extensions.caching.memory.8.0.0.nupkg | Transitive | N/A* | &#10060;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> Reachable |
| [CVE-2024-35255](https://www.mend.io/vulnerability-database/CVE-2024-35255) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.5 | Unproven | 0.1% | detected in multiple dependencies | Transitive | N/A* | &#10060;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> Reachable |
| [CVE-2024-29992](https://www.mend.io/vulnerability-database/CVE-2024-29992) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.5 | Not Defined | 0.6% | azure.identity.1.10.3.nupkg | Transitive | N/A* | &#10060;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> Reachable |
| [CVE-2024-27086](https://www.mend.io/vulnerability-database/CVE-2024-27086) | <img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> Low | 3.9 | Not Defined | 0.1% | microsoft.identity.client.4.56.0.nupkg | Transitive | N/A* | &#10060;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> Reachable |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> CVE-2024-43485</summary>


### Vulnerable Library - system.text.json.8.0.4.nupkg

Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data.

The System.Text.Json library is built-in as part of the shared framework in .NET Runtime. The package can be installed when you need to use it in other target frameworks.
Library home page: <a href="https://api.nuget.org/packages/system.text.json.8.0.4.nupkg">https://api.nuget.org/packages/system.text.json.8.0.4.nupkg</a>
Path to dependency file: /DotNetCliCodeSnippets/DotnetCliCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/8.0.4/system.text.json.8.0.4.nupkg


Dependency Hierarchy:
 - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg (Root Library)
 - microsoft.data.sqlclient.5.1.5.nupkg
 - microsoft.identitymodel.jsonwebtokens.6.35.0.nupkg
 - :x: **system.text.json.8.0.4.nupkg** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Vonage/vonage-dotnet-code-snippets/commit/3edaf92a0a3aa3d7441e08d996d889594d4650f6">3edaf92a0a3aa3d7441e08d996d889594d4650f6</a>
Found in base branch: master




### Reachability Analysis
This vulnerability is potentially reachable

```
System.Text.Json.Serialization.Converters.ConcurrentQueueOfTConverter (Application)
 -> System.Text.Json.Serialization.Metadata.JsonMetadataServices (Extension)
 -> System.Text.Json.Serialization.Metadata.JsonTypeInfo (Extension)
 -> System.Text.Json.ThrowHelper (Extension)
 ...
 -> Vonage.Common.Serialization.EnumDescriptionJsonConverter (Extension)
 -> Vonage.Meetings.CreateRoom.CreateRoomRequest (Extension)
 -> ❌ DotnetCliCodeSnippets.Meetings.CreateInstantRoom (Vulnerable Component)

```







### Vulnerability Details
 
 
.NET and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-10-08
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-43485>CVE-2024-43485</a>




### Threat Assessment
 

Exploit Maturity: Unproven
EPSS: 3.4%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-8g4q-xg66-9fp4">https://github.com/advisories/GHSA-8g4q-xg66-9fp4</a>
Release Date: 2024-10-08
Fix Resolution: System.Text.Json - 6.0.10,8.0.5





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> CVE-2024-43483</summary>


### Vulnerable Library - microsoft.extensions.caching.memory.8.0.0.nupkg

In-memory cache implementation of Microsoft.Extensions.Caching.Memory.IMemoryCache.
Library home page: <a href="https://api.nuget.org/packages/microsoft.extensions.caching.memory.8.0.0.nupkg">https://api.nuget.org/packages/microsoft.extensions.caching.memory.8.0.0.nupkg</a>
Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.extensions.caching.memory/8.0.0/microsoft.extensions.caching.memory.8.0.0.nupkg


Dependency Hierarchy:
 - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg (Root Library)
 - microsoft.entityframeworkcore.relational.8.0.8.nupkg
 - microsoft.entityframeworkcore.8.0.8.nupkg
 - :x: **microsoft.extensions.caching.memory.8.0.0.nupkg** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Vonage/vonage-dotnet-code-snippets/commit/3edaf92a0a3aa3d7441e08d996d889594d4650f6">3edaf92a0a3aa3d7441e08d996d889594d4650f6</a>
Found in base branch: master




### Reachability Analysis
This vulnerability is potentially reachable

```
System.Runtime.CompilerServices.NullableAttribute (Application)
 -> Vonage.Common.Client.VonageHttpClientConfiguration (Extension)
 -> Vonage.Conversations.ConversationsClient (Extension)
 -> ❌ DotnetCliCodeSnippets.Conversation.Member.CreateMember (Vulnerable Component)

```







### Vulnerability Details
 
 
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-10-08
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-43483>CVE-2024-43483</a>




### Threat Assessment
 

Exploit Maturity: Unproven
EPSS: 11.900001%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/dotnet/runtime/security/advisories/GHSA-qj66-m88j-hmgj">https://github.com/dotnet/runtime/security/advisories/GHSA-qj66-m88j-hmgj</a>
Release Date: 2024-10-08
Fix Resolution: System.IO.Packaging - 6.0.1,8.0.1,9.0.0-rc.2.24473.5, Microsoft.Extensions.Caching.Memory - 6.0.2,8.0.1,9.0.0-rc.2.24473.5, System.Security.Cryptography.Cose - 8.0.1,9.0.0-rc.2.24473.5





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> CVE-2024-35255</summary>


### Vulnerable Libraries - microsoft.identity.client.4.56.0.nupkg, azure.identity.1.10.3.nupkg



### microsoft.identity.client.4.56.0.nupkg

This package contains the binaries of the Microsoft Authentication Library for .NET (MSAL.NET).
 
Library home page: <a href="https://api.nuget.org/packages/microsoft.identity.client.4.56.0.nupkg">https://api.nuget.org/packages/microsoft.identity.client.4.56.0.nupkg</a>
Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identity.client/4.56.0/microsoft.identity.client.4.56.0.nupkg


Dependency Hierarchy:
 - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg (Root Library)
 - microsoft.data.sqlclient.5.1.5.nupkg
 - :x: **microsoft.identity.client.4.56.0.nupkg** (Vulnerable Library)


### azure.identity.1.10.3.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity
Library home page: <a href="https://api.nuget.org/packages/azure.identity.1.10.3.nupkg">https://api.nuget.org/packages/azure.identity.1.10.3.nupkg</a>
Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.10.3/azure.identity.1.10.3.nupkg


Dependency Hierarchy:
 - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg (Root Library)
 - microsoft.data.sqlclient.5.1.5.nupkg
 - :x: **azure.identity.1.10.3.nupkg** (Vulnerable Library)


Found in HEAD commit: <a href="https://github.com/Vonage/vonage-dotnet-code-snippets/commit/3edaf92a0a3aa3d7441e08d996d889594d4650f6">3edaf92a0a3aa3d7441e08d996d889594d4650f6</a>
Found in base branch: master




### Reachability Analysis
This vulnerability is potentially reachable

```
DotnetCliCodeSnippets.Messages.WhatsApp.SendWhatsAppMtm (Application)
 -> Vonage.VonageClient (Extension)
 -> Vonage.SimSwap.SimSwapClient (Extension)
 -> Vonage.Serialization.JsonSerializerBuilder (Extension)
 ...
 -> System.Text.Json.JsonSerializerOptions (Extension)
 -> System.Text.Json.JsonDocumentOptions (Extension)
 -> ❌ System.Runtime.CompilerServices.IsReadOnlyAttribute (Vulnerable Component)

```







### Vulnerability Details
 
 
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Publish Date: 2024-06-11
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-35255>CVE-2024-35255</a>




### Threat Assessment
 

Exploit Maturity: Unproven
EPSS: 0.1%




### CVSS 3 Score Details (5.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-m5vv-6r4h-3vj9">https://github.com/advisories/GHSA-m5vv-6r4h-3vj9</a>
Release Date: 2024-06-11
Fix Resolution: @azure/identity - 4.2.1, @azure/msal-node - 2.9.1, Azure.Identity - 1.11.4, Microsoft.Identity.Client - 4.61.3, azure-identity - 1.16.1, com.azure:azure-identity:1.12.2, github.com/Azure/azure-sdk-for-go/sdk/azidentity - 1.6.0





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> CVE-2024-29992</summary>


### Vulnerable Library - azure.identity.1.10.3.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity
Library home page: <a href="https://api.nuget.org/packages/azure.identity.1.10.3.nupkg">https://api.nuget.org/packages/azure.identity.1.10.3.nupkg</a>
Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.10.3/azure.identity.1.10.3.nupkg


Dependency Hierarchy:
 - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg (Root Library)
 - microsoft.data.sqlclient.5.1.5.nupkg
 - :x: **azure.identity.1.10.3.nupkg** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Vonage/vonage-dotnet-code-snippets/commit/3edaf92a0a3aa3d7441e08d996d889594d4650f6">3edaf92a0a3aa3d7441e08d996d889594d4650f6</a>
Found in base branch: master




### Reachability Analysis
This vulnerability is potentially reachable

```
DotnetCliCodeSnippets.Meetings.CreateInstantRoom (Application)
 -> Vonage.VonageClient (Extension)
 -> Vonage.SubAccounts.SubAccountsClient (Extension)
 -> Vonage.Common.JsonSerializer (Extension)
 -> System.Text.Json.JsonSerializer (Extension)
 -> ❌ System.Diagnostics.CodeAnalysis.RequiresUnreferencedCodeAttribute (Vulnerable Component)

```







### Vulnerability Details
 
 
Azure Identity Library for .NET Information Disclosure Vulnerability

Publish Date: 2024-04-09
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-29992>CVE-2024-29992</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.6%




### CVSS 3 Score Details (5.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-29992">https://nvd.nist.gov/vuln/detail/CVE-2024-29992</a>
Release Date: 2024-04-09
Fix Resolution: Appi - no_fix





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> CVE-2024-27086</summary>


### Vulnerable Library - microsoft.identity.client.4.56.0.nupkg

This package contains the binaries of the Microsoft Authentication Library for .NET (MSAL.NET).
 
Library home page: <a href="https://api.nuget.org/packages/microsoft.identity.client.4.56.0.nupkg">https://api.nuget.org/packages/microsoft.identity.client.4.56.0.nupkg</a>
Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identity.client/4.56.0/microsoft.identity.client.4.56.0.nupkg


Dependency Hierarchy:
 - microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg (Root Library)
 - microsoft.data.sqlclient.5.1.5.nupkg
 - :x: **microsoft.identity.client.4.56.0.nupkg** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Vonage/vonage-dotnet-code-snippets/commit/3edaf92a0a3aa3d7441e08d996d889594d4650f6">3edaf92a0a3aa3d7441e08d996d889594d4650f6</a>
Found in base branch: master




### Reachability Analysis
This vulnerability is potentially reachable

```
DotnetCliCodeSnippets.Messages.WhatsApp.SendWhatsAppMtm (Application)
 -> Vonage.Messages.WhatsApp.WhatsAppTemplateRequest (Extension)
 -> System.Runtime.CompilerServices.IsReadOnlyAttribute (Extension)
 -> ❌ Microsoft.CodeAnalysis.EmbeddedAttribute (Vulnerable Component)

```







### Vulnerability Details
 
 
The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. 
A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.

Publish Date: 2024-04-16
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-27086>CVE-2024-27086</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (3.9)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: Low
 - User Interaction: Required
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: Low
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-27086">https://nvd.nist.gov/vuln/detail/CVE-2024-27086</a>
Release Date: 2024-04-16
Fix Resolution: DbExpression.Tools - no_fix





</details>

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg version)	Remediation Possible**	Reachability
CVE-2024-43485	High	7.5	Unproven	3.4%	system.text.json.8.0.4.nupkg	Transitive	N/A*	❌	Reachable
CVE-2024-43483	High	7.5	Unproven	11.900001%	microsoft.extensions.caching.memory.8.0.0.nupkg	Transitive	N/A*	❌	Reachable
CVE-2024-35255	Medium	5.5	Unproven	0.1%	detected in multiple dependencies	Transitive	N/A*	❌	Reachable
CVE-2024-29992	Medium	5.5	Not Defined	0.6%	azure.identity.1.10.3.nupkg	Transitive	N/A*	❌	Reachable
CVE-2024-27086	Low	3.9	Not Defined	0.1%	microsoft.identity.client.4.56.0.nupkg	Transitive	N/A*	❌	Reachable

microsoft.entityframeworkcore.sqlserver.8.0.8.nupkg: 5 vulnerabilities (highest severity is: 7.5) reachable #105

Description

Vulnerabilities

Details

Vulnerable Library - system.text.json.8.0.4.nupkg

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - microsoft.extensions.caching.memory.8.0.0.nupkg

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Libraries - microsoft.identity.client.4.56.0.nupkg, azure.identity.1.10.3.nupkg

microsoft.identity.client.4.56.0.nupkg

azure.identity.1.10.3.nupkg

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerable Library - azure.identity.1.10.3.nupkg

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerable Library - microsoft.identity.client.4.56.0.nupkg

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (3.9)

Suggested Fix

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions