[AVRO-3963] Apache.Avro .NET shows vulnerabilities

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.11.3
• Component/s: csharp
• Assignee: Unassigned
• Reporter: Ricardo Minguez
• Created: 20/Mar/24 00:04
• Updated: 21/Mar/24 07:34
• Resolved: 21/Mar/24 07:34

Description

The NuGet Package [NuGet Gallery | Apache.Avro 1.11.3|https://www.nuget.org/packages/Apache.Avro/1.11.3]

has dependencies on vulnerable packages, the command 

dotnet list package --include-transitive --vulnerable
 
shows vulnerabilities classified as High
 

> Newtonsoft.Json 10.0.3 High https://github.com/advisories/GHSA-5crp-9r3c-p9vr
> System.Net.Http 4.3.0 High https://github.com/advisories/GHSA-7jgj-8wvc-jh57
> System.Text.RegularExpressions 4.3.0 High https://github.com/advisories/GHSA-cmhx-cq75-c4mj

Issue Links

• Is contained by: AVRO-3906 Add NET 8.0 support