Resolve CVE-2024-43485

[borrow-checker]

Resolves GHSA-8g4q-xg66-9fp4.

[idimov-keeper]

8.05 is still affected version
Patched versions are: 8.0.10 (or 6.0.35)
see GHSA-8g4q-xg66-9fp4

[borrow-checker]

8.05 is still affected version Patched versions are: 8.0.10 (or 6.0.35) see GHSA-8g4q-xg66-9fp4

@idimov-keeper
According to that advisory 8.0.5 is the patched version. Furthermore, 8.0.10 doesn't exist on nuget.

[mike-jumper]

8.05 is still affected version Patched versions are: 8.0.10 (or 6.0.35) see GHSA-8g4q-xg66-9fp4

@idimov-keeper According to that advisory 8.0.5 is the patched version. Furthermore, 8.0.10 doesn't exist on nuget.

FYI:

• Microsoft's own advisory notes 8.0.10 as being the version with the update: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485
• The actual, official CVE notes that it's 8.0.10 that fixes the issue: https://www.cve.org/CVERecord?id=CVE-2024-43485

If GitHub's advisory notes 8.0.5, it might just be wrong. I have yet to find any documentation outside GitHub's advisory that supports 8.0.5 as being the fixed version.

[borrow-checker]

8.05 is still affected version Patched versions are: 8.0.10 (or 6.0.35) see GHSA-8g4q-xg66-9fp4

@idimov-keeper According to that advisory 8.0.5 is the patched version. Furthermore, 8.0.10 doesn't exist on nuget.

FYI:

• Microsoft's own advisory notes 8.0.10 as being the version with the update: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485
• The actual, official CVE notes that it's 8.0.10 that fixes the issue: https://www.cve.org/CVERecord?id=CVE-2024-43485

If GitHub's advisory notes 8.0.5, it might just be wrong. I have yet to find any documentation outside GitHub's advisory that supports 8.0.5 as being the fixed version.

@mike-jumper that's the .NET sdk build not the library version
If you look at nuget, it's the latest stable release, and released like 15 hours ago