In our .NET 6 apis we are using Simple Injector for dependency injection. With the latest version of Simple Injector, we observed that Snyk found five high-priority vulnerabilities and two medium vulnerabilities in SimpleInjector.Integration.AspNetCore.Mvc v5.4.0. You can see one of them in the image below. All of them are probably caused by dependencies to an older version of the .NET Framework/runtime. Is it possible to provide a solution for these issues in the near future?
1 Answer
Is it possible to provide a solution for these issues in the near future?
If you look closely at the threat analysis, you'll notice that the issue not lies with the SimpleInjector.Integration.AspNetCore.Mvc
package itself, but with the dependencies the package points at. It is, therefore, not an issue for the Simple Injector packages to fix, as all package authors would constantly have to upgrade their packages when there is a security flaw found in their dependency chain. The NuGet infrastructure is actually designed for these scenarios as a package lists its dependencies with the minimum compatible version. It's up to the application developer to select the most suitable version of those dependencies.
The solution is, therefore, straightforward: You, as an application developer should check whether the vulnerability affects your application, and if so (or when in doubt), act by updating the vulnerable dependencies in your application. If the vulnerable package isn't explicitly installed in your application, you should do so, and install a version that is not vulnerable.
Concretely, in your case the vulnerability lies in System.Net.Http
, which means you should probably explicitly install that package in your application and upgrade to at least version 4.3.4, as this is the version that fixed the problem.
-
1Thanks, after updating System.Net.Http Snyk didn't complain anymore. Nov 3, 2022 at 9:43