Skip to content

System.Text.Json version 8.0.4 transitive reference issue via Serilog.AspNetCore 8.0.2 - CVE-2024-43485 #382

@tvbishan

Description

@tvbishan

Description
I encountered an issue with a transitive reference to System.Text.Json version 8.0.4 when using Serilog.AspNetCore version 8.0.2. The package reference is shown as a warning in the NuGet package manager (screenshot attached).

Reproduction

  1. Add Serilog.AspNetCore version 8.0.2 to the project.
  2. Observe the transitive dependency on System.Text.Json 8.0.4 in the package manager.

Expected behavior
Either no warning or an explanation of how this transitive dependency is safe to use.

Relevant package, tooling and runtime versions

  • Serilog.AspNetCore: 8.0.2
  • Target Framework: .NET Core 6, .NET Core 8
  • System.Text.Json: Transitive version 8.0.4

image
image

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions