{"id":"GHSA-gpv5-rp6w-58r8","summary":"Remote code execution vulnerability in dependency System.Drawing.Common","details":"### Impact\n\nThe core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.\n\nThe real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.\n\n### References\n_Are there any links users can visit to find out more?_\n\nOriginal issue: https://github.com/akkadotnet/akka.net/issues/6226\nMSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new)\n* Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)\n","modified":"2024-12-04T05:32:04.565831Z","published":"2022-11-22T00:13:44Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-11-22T00:13:44Z","nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/akkadotnet/akka.net/security/advisories/GHSA-gpv5-rp6w-58r8"},{"type":"PACKAGE","url":"https://github.com/akkadotnet/akka.net"}],"affected":[{"package":{"name":"Akka","ecosystem":"NuGet","purl":"pkg:nuget/Akka"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.46"}]}],"versions":["0.2.0-beta","0.2.1-beta","0.5.0","0.5.2","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.7.0","0.7.1","0.8.0","1.0.0","1.0.0-dev1504032244","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.19","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.0-beta1","1.4.0-beta2","1.4.0-beta3","1.4.0-beta4","1.4.1","1.4.1-rc1","1.4.1-rc2","1.4.1-rc3","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.21-beta1","1.4.22","1.4.23","1.4.24","1.4.25","1.4.26","1.4.27","1.4.28","1.4.29","1.4.3","1.4.30","1.4.31","1.4.32","1.4.33","1.4.34","1.4.35","1.4.36","1.4.37","1.4.38","1.4.39","1.4.4","1.4.40","1.4.41","1.4.42","1.4.43","1.4.44","1.4.45","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-gpv5-rp6w-58r8/GHSA-gpv5-rp6w-58r8.json"}},{"package":{"name":"Akka","ecosystem":"NuGet","purl":"pkg:nuget/Akka"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0-alpha1"},{"fixed":"1.5.0-alpha3"}]}],"versions":["1.5.0-alpha1","1.5.0-alpha2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-gpv5-rp6w-58r8/GHSA-gpv5-rp6w-58r8.json"}}],"schema_version":"1.9.0"}