chore(deps): update terraform modules

[renovate]

Motivation

Automated dependency update by Renovate bot.

Description

This PR contains the following updates:

Package	Type	Update	Change
external (source)	required_provider	patch	>= 2.4.0 → >= 2.4.1
time (source)	required_provider	patch	0.14.0 → 0.14.1

Testing

This is an automated dependency update. No functional changes are expected.

Impact

---

Release Notes

hashicorp/terraform-provider-external (external)

v2.4.1

Compare Source

NOTES:

• Dependency updates (#​500)

hashicorp/terraform-provider-time (time)

v0.14.1

Compare Source

NOTES:

• Dependency updates (#​498)

Additional Information

---

• If you want to rebase/retry this PR, check this box

This PR was generated automatically by Renovate.

[github-actions]

🔍 Vulnerabilities of dockerhubaneo/armonik_core_stream_test_client:0.41.0-renovateterraformprovider.107.sha.20826656

📦 Image Reference dockerhubaneo/armonik_core_stream_test_client:0.41.0-renovateterraformprovider.107.sha.20826656

digest	sha256:c6ecd1ba6b06af1bbc6e510640891f972a4e6068895b0830de46bf7432fc9b7d
vulnerabilities
platform	linux/amd64
size	344 MB
packages	1131

📦 Base Image oisupport/staging-amd64:24.04

also known as	a215e986b44aae6f10795ded1e39ce93d9c236d8163d21a522ffd0ab3659f546 noble noble-20260730.1
digest	sha256:019e8eb29a85e74d64925745884f2ec79aa27e3feab36353d24656f4d6b89467
vulnerabilities

System.Security.Cryptography.Xml 10.0.6 (nuget) pkg:nuget/System.Security.Cryptography.Xml@10.0.6 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Insufficient Verification of Data Authenticity Affected range >=10.0.0 <=10.0.9 Fixed version 10.0.10 CVSS Score 8.1 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.216% EPSS Percentile 12th percentile Description Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability to bypass encryption protections and access encrypted data. Announcement Announcement for this issue can be found at dotnet/announcements#412. CVSS Details Version: 3.1 Severity: High Score: 8.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Weakness: CWE-347 (Improper Verification of Cryptographic Signature) Affected Platforms Platforms: All Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 10.0.0, <= 10.0.9 10.0.10 .NET 9.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 9.0.0, <= 9.0.17 9.0.18 .NET 8.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.3 8.0.4 Advisory FAQ How do I know if I am affected? If using a package listed in affected packages, you're exposed to the vulnerability. How do I fix the issue? To update the System.Security.Cryptography.Xml NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: Open your project in Visual Studio. Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: Open your project in Visual Studio. Navigate to "Tools > NuGet Package Manager > Package Manager Console". To update a specific package to its latest version, use the following Update-Package command: Update-Package -Id System.Security.Cryptography.Xml Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version, use the following add package command: dotnet add package System.Security.Cryptography.Xml Once you have updated the nuget package reference you must recompile and deploy your application. Additionally we recommend you update your runtime and/or SDKs, but it is not necessary to patch the vulnerability. Other Information Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ. Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links CVE-2026-47304 Acknowledgements Levi Broderick with Microsoft Revisions V1.0 (July 14, 2026): Advisory published. Allocation of Resources Without Limits or Throttling Affected range >=10.0.0 <=10.0.9 Fixed version 10.0.10 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.840% EPSS Percentile 55th percentile Description Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML that causes uncontrolled resource consumption, resulting in denial of service. Announcement Announcement for this issue can be found at dotnet/announcements#416 CVSS Details Version: 3.1 Severity: High Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms Platforms: All Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 10.0.0, <= 10.0.9 10.0.10 .NET 9.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 9.0.0, <= 9.0.17 9.0.18 .NET 8.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.3 8.0.4 Advisory FAQ How do I know if I am affected? If using a package listed in affected packages, you're exposed to the vulnerability. How do I fix the issue? To update the System.Security.Cryptography.Xml NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: Open your project in Visual Studio. Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: Open your project in Visual Studio. Navigate to "Tools > NuGet Package Manager > Package Manager Console". To update a specific package to its latest version, use the following Update-Package command: Update-Package -Id System.Security.Cryptography.Xml Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version, use the following add package command: dotnet add package System.Security.Cryptography.Xml Once you have updated the nuget package reference you must recompile and deploy your application. Additionally we recommend you update your runtime and/or SDKs, but it is not necessary to patch the vulnerability. Other Information Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ. Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links CVE-2026-50648 Acknowledgements 41ae55e9310ff27fa6f26af4727e5590 Revisions V1.0 (July 14, 2026): Advisory published. Stack-based Buffer Overflow Affected range >=10.0.0 <=10.0.9 Fixed version 10.0.10 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.840% EPSS Percentile 55th percentile Description Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML that is improperly validated, resulting in denial of service. Announcement Announcement for this issue can be found at dotnet/announcements#416 CVSS Details Version: 3.1 Severity: High Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Weakness: CWE-121 (Stack-based Buffer Overflow) Affected Platforms Platforms: All Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 10.0.0, <= 10.0.9 10.0.10 .NET 9.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 9.0.0, <= 9.0.17 9.0.18 .NET 8.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.3 8.0.4 Advisory FAQ How do I know if I am affected? If using a package listed in affected packages, you're exposed to the vulnerability. How do I fix the issue? To update the System.Security.Cryptography.Xml NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: Open your project in Visual Studio. Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: Open your project in Visual Studio. Navigate to "Tools > NuGet Package Manager > Package Manager Console". To update a specific package to its latest version, use the following Update-Package command: Update-Package -Id System.Security.Cryptography.Xml Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version, use the following add package command: dotnet add package System.Security.Cryptography.Xml Once you have updated the nuget package reference you must recompile and deploy your application. Additionally we recommend you update your runtime and/or SDKs, but it is not necessary to patch the vulnerability. Other Information Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ. Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links CVE-2026-50527 Acknowledgements Levi Broderick with Microsoft Revisions V1.0 (July 14, 2026): Advisory published. Allocation of Resources Without Limits or Throttling Affected range >=10.0.0 <=10.0.9 Fixed version 10.0.10 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.604% EPSS Percentile 46th percentile Description Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML that causes uncontrolled resource consumption, resulting in denial of service. Announcement Announcement for this issue can be found at dotnet/announcements#414 CVSS Details Version: 3.1 Severity: High Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms Platforms: All Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 10.0.0, <= 10.0.9 10.0.10 .NET 9.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 9.0.0, <= 9.0.17 9.0.18 .NET 8.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.3 8.0.4 Advisory FAQ How do I know if I am affected? If using a package listed in affected packages, you're exposed to the vulnerability. How do I fix the issue? To update the System.Security.Cryptography.Xml NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: Open your project in Visual Studio. Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: Open your project in Visual Studio. Navigate to "Tools > NuGet Package Manager > Package Manager Console". To update a specific package to its latest version, use the following Update-Package command: Update-Package -Id System.Security.Cryptography.Xml Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version, use the following add package command: dotnet add package System.Security.Cryptography.Xml Once you have updated the nuget package reference you must recompile and deploy your application. Additionally we recommend you update your runtime and/or SDKs, but it is not necessary to patch the vulnerability. Other Information Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ. Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links CVE-2026-50525 Acknowledgements Levi Broderick with Microsoft Revisions V1.0 (July 14, 2026): Advisory published. Allocation of Resources Without Limits or Throttling Affected range >=10.0.0 <=10.0.9 Fixed version 10.0.10 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 1.029% EPSS Percentile 61st percentile Description Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash. Announcement Announcement for this issue can be found at dotnet/announcements#410 CVSS Details Version: 3.1 Severity: High Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms Platforms: All Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.linux-arm >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.linux-arm64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.linux-musl-arm >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.linux-musl-arm64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.linux-musl-x64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.linux-x64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.osx-arm64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.osx-x64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.win-arm >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.win-arm64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.win-x64 >= 10.0.0, <= 10.0.9 10.0.10 Microsoft.NetCore.App.Runtime.win-x86 >= 10.0.0, <= 10.0.9 10.0.10 .NET 9.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.linux-arm >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.linux-arm64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.linux-musl-arm >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.linux-musl-arm64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.linux-musl-x64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.linux-x64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.osx-arm64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.osx-x64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.win-arm >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.win-arm64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.win-x64 >= 9.0.0, <= 9.0.17 9.0.18 Microsoft.NetCore.App.Runtime.win-x86 >= 9.0.0, <= 9.0.17 9.0.18 .NET 8.0 Package name Affected version Patched version System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.3 8.0.4 Microsoft.NetCore.App.Runtime.linux-arm >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.linux-arm64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.linux-musl-arm >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.linux-musl-arm64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.linux-musl-x64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.linux-x64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.osx-arm64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.osx-x64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.win-arm >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.win-arm64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.win-x64 >= 8.0.0, <= 8.0.28 8.0.29 Microsoft.NetCore.App.Runtime.win-x86 >= 8.0.0, <= 8.0.28 8.0.29 Advisory FAQ How do I know if I am affected? If using a package listed in affected packages, you're exposed to the vulnerability. How do I fix the issue? To update the System.Security.Cryptography.Xml NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: Open your project in Visual Studio. Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: Open your project in Visual Studio. Navigate to "Tools > NuGet Package Manager > Package Manager Console". To update a specific package to its latest version, use the following Update-Package command: Update-Package -Id System.Security.Cryptography.Xml Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version, use the following add package command: dotnet add package System.Security.Cryptography.Xml Once you have updated the nuget package reference you must recompile and deploy your application. Additionally we recommend you update your runtime and/or SDKs, but it is not necessary to patch the vulnerability. Other Information Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ. Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links CVE-2026-47302 Acknowledgements Levi Broderick with Microsoft Revisions V1.0 (July 14, 2026): Advisory published.

libudev1 255.4-1ubuntu8.16 (deb) pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=systemd # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range <255.4-1ubuntu8.17 Fixed version 255.4-1ubuntu8.17 EPSS Score 0.057% EPSS Percentile 0th percentile Description systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user Affected range <255.4-1ubuntu8.17 Fixed version 255.4-1ubuntu8.17 EPSS Score 0.119% EPSS Percentile 2nd percentile Description Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N EPSS Score 0.173% EPSS Percentile 7th percentile Description In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

util-linux 2.39.3-9ubuntu6.5 (deb) pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.118% EPSS Percentile 2nd percentile Description util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

git 1:2.43.0-1ubuntu7.3 (deb) pkg:deb/ubuntu/git@1%3A2.43.0-1ubuntu7.3?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 0.513% EPSS Percentile 41st percentile Description Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

libp11-kit0 0.25.3-4ubuntu2.1 (deb) pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=p11-kit # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.144% EPSS Percentile 4th percentile Description A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

wget 1.21.4-1ubuntu4.4 (deb) pkg:deb/ubuntu/wget@1.21.4-1ubuntu4.4?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 1.104% EPSS Percentile 63rd percentile Description GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

dpkg 1.22.6ubuntu6.6 (deb) pkg:deb/ubuntu/dpkg@1.22.6ubuntu6.6?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.418% EPSS Percentile 35th percentile Description It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

libexpat1 2.6.1-2ubuntu0.4 (deb) pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.4?arch=amd64&distro=ubuntu-24.04&upstream=expat # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.206% EPSS Percentile 11th percentile Description In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

libgcrypt20 1.10.3-2ubuntu0.1 (deb) pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=amd64&distro=ubuntu-24.04 # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 1.114% EPSS Percentile 63rd percentile Description A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

libicu74 74.2-1ubuntu3.1 (deb) pkg:deb/ubuntu/libicu74@74.2-1ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=icu # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.315% EPSS Percentile 24th percentile Description A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

zlib1g 1:1.3.dfsg-3.1ubuntu2.1 (deb) pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=zlib # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.218% EPSS Percentile 12th percentile Description zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

passwd 1:4.13+dfsg1-4ubuntu3.2 (deb) pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow # Dockerfile (3:10) FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux USER $APP_UID ENTRYPOINT [ "dotnet" ] FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"] FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux Affected range >=0 Fixed version Not Fixed EPSS Score 0.408% EPSS Percentile 34th percentile Description shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud