Skip to content

Commit

Permalink
Fix: Newtonsoft.Json prior to version 13.0.1 is vulnerable
Browse files Browse the repository at this point in the history
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS).
  • Loading branch information
axunonb committed Jun 28, 2022
1 parent d64c240 commit 3306a41
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 7 deletions.
6 changes: 3 additions & 3 deletions appveyor.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
version: 2.7.2.{build}
version: 2.7.3.{build}
environment:
DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
image: Visual Studio 2019
Expand All @@ -8,7 +8,7 @@ build_script:
- ps: dotnet add .\SmartFormat.Tests\SmartFormat.Tests.csproj package AltCover
- ps: dotnet build SmartFormat.sln /verbosity:minimal /t:rebuild /p:configuration=release /nowarn:CS1591,CS0618
- ps: |
$version = "2.7.2"
$version = "2.7.3"
$versionFile = $version + "." + ${env:APPVEYOR_BUILD_NUMBER}
if ($env:APPVEYOR_PULL_REQUEST_NUMBER) {
Expand All @@ -29,4 +29,4 @@ deploy:
api_key:
secure: siTK+zMCX6XYTT2G7uhX9XjB6LNhDtZheum/MKIfrnsBITjZ+yEGAPNKVL/LCEPB
on:
branch: main
branch: version/2.7.3
8 changes: 4 additions & 4 deletions src/SmartFormat/SmartFormat.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
<PropertyGroup>
<Description>A string composition library written in C# that can format data into a string with a minimal, intuitive syntax. It uses extensions to provide named placeholders, pluralization, gender conjugation, and time and list formatting.</Description>
<AssemblyTitle>SmartFormat</AssemblyTitle>
<Version>2.7.2</Version>
<FileVersion>2.7.2</FileVersion>
<Version>2.7.3</Version>
<FileVersion>2.7.3</FileVersion>
<TargetFrameworks>netstandard2.0;net461</TargetFrameworks>
<DefineConstants>TRACE;DEBUG</DefineConstants>
<GenerateDocumentationFile>true</GenerateDocumentationFile>
Expand Down Expand Up @@ -53,9 +53,9 @@ https://github.com/axuno/SmartFormat/blob/master/CHANGES.md</PackageReleaseNotes
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="Newtonsoft.Json" Version="12.0.3" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
<PackageReference Include="System.ValueTuple" Version="4.5.0" />
<PackageReference Include="System.Text.Json" Version="4.7.2" />
<PackageReference Include="System.Text.Json" Version="6.0.5" />
</ItemGroup>

</Project>

0 comments on commit 3306a41

Please sign in to comment.