[
https://issues.apache.org/jira/browse/AVRO-3551?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17561950#comment-17561950
]
Kalle Niemitalo commented on AVRO-3551:
---------------------------------------
versions.props defines two MSBuild properties for the version of
Newtonsoft.Json:
-
[<NewtonsoftJsonVersion>12.0.3</NewtonsoftJsonVersion>|https://github.com/apache/avro/blob/4e1fefca493029ace961b7ef8889a3722458565a/lang/csharp/versions.props#L29]
for the Apache.Avro.Tools package, i.e. the avrogen tool. This could be
increased to 13.0.1 but I don't think it's urgent, because avrogen is not
typically used on untrusted input and a successful attack would only cause
denial of service.
-
[<NewtonsoftJsonMinimumVersion>10.0.3</NewtonsoftJsonMinimumVersion>|https://github.com/apache/avro/blob/4e1fefca493029ace961b7ef8889a3722458565a/lang/csharp/versions.props#L44]
for the Apache.Avro package, i.e. the main library. This one has a comment
saying it should usually not be updated, and that applications using the
library can declare a direct dependency on a newer version of Newtonsoft.Json
if they need one. There is some rationale in
[https://github.com/apache/avro/pull/981#discussion_r525692847]. I don't know
whether the security issue justifies a forced upgrade now.
The Newtonsoft.Json 10.0.3 package contains a "tools" folder but 11.0.1 and
later versions don't. This difference can cause difficulty during an upgrade,
if the application references {{$(PkgNewtonsoft_Json)}} in its build system and
needs to stay compatible with older Visual Studio versions that don't support
[GeneratePathProperty metadata on
PackageReference|https://docs.microsoft.com/nuget/consume-packages/package-references-in-project-files#generatepathproperty].
> Security Vulnerability - WS-2022-0161 in Newtonsoft dependendy
> --------------------------------------------------------------
>
> Key: AVRO-3551
> URL: https://issues.apache.org/jira/browse/AVRO-3551
> Project: Apache Avro
> Issue Type: Bug
> Components: csharp
> Affects Versions: 1.11.0
> Reporter: Michael Ahrens
> Priority: Major
>
> Please upgrade Newtonsoft dependency to 13.0.1 in next version. Below
> versions have a security vulnerability: WS-2022-0161
> Thanks
> Michael
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
