0

In our .NET 6 apis we are using Simple Injector for dependency injection. With the latest version of Simple Injector, we observed that Snyk found five high-priority vulnerabilities and two medium vulnerabilities in SimpleInjector.Integration.AspNetCore.Mvc v5.4.0. You can see one of them in the image below. All of them are probably caused by dependencies to an older version of the .NET Framework/runtime. Is it possible to provide a solution for these issues in the near future?

Snyk vulnerability

1
  • This is a question unsuited for Stack Overflow and is better suited for the Simple Injector forum on GitHub.
    – Steven
    Oct 21, 2022 at 8:03

1 Answer 1

1

Is it possible to provide a solution for these issues in the near future?

If you look closely at the threat analysis, you'll notice that the issue not lies with the SimpleInjector.Integration.AspNetCore.Mvc package itself, but with the dependencies the package points at. It is, therefore, not an issue for the Simple Injector packages to fix, as all package authors would constantly have to upgrade their packages when there is a security flaw found in their dependency chain. The NuGet infrastructure is actually designed for these scenarios as a package lists its dependencies with the minimum compatible version. It's up to the application developer to select the most suitable version of those dependencies.

The solution is, therefore, straightforward: You, as an application developer should check whether the vulnerability affects your application, and if so (or when in doubt), act by updating the vulnerable dependencies in your application. If the vulnerable package isn't explicitly installed in your application, you should do so, and install a version that is not vulnerable.

Concretely, in your case the vulnerability lies in System.Net.Http, which means you should probably explicitly install that package in your application and upgrade to at least version 4.3.4, as this is the version that fixed the problem.

1
  • 1
    Thanks, after updating System.Net.Http Snyk didn't complain anymore. Nov 3, 2022 at 9:43

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.