[GHSA-hxrm-9w7p-39cc] Cookie parsing failure

[skofman1]

Updates

• Affected products

Comments
Fixing packages list

[CallmeMari]

Hello @skofman1, we appreciate your contribution to the Advisory Database. Do you have any references to justify the changes you propose?

[skofman1]

@CallmeMari , the data in this advisory was sourced from an issue I originally created here: #302
Since then, we have reviewed the data internally, and found some issues that we are fixing now.

[CallmeMari]

Hello @skofman1, I apologize that this PR was closed in error. Your proposed changes have been updated, please review the package names and version ranges at your earliest convenience. There are two packages where the versions were not available in the registry:

1. Microsoft.AspNetCore.App.Runtime.linux-musl-arm, there are no versions prior to 5.0.1 https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm/7.0.0-preview.7.22376.6. What vulnerable range would you like us to add for this package?

2. Microsoft.AspNetCore.App.Runtime.win-arm64, version 3.1.0 doesn't exist on the registry, the earliest version is 3.1.5 https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64/7.0.0-preview.7.22376.6. What vulnerable range would you like us to add for this package?

[skofman1]

@CallmeMari, thanks for catching those!

@leecow can you help?

[leecow]

Hopefully, this takes care of the remaining issue:

• Remove Microsoft.AspNetCore.App.Runtime.linux-musl-arm from the affected package list.
• Vulnerable version range for Microsoft.AspNetCore.App.Runtime.win-arm64 should be >= 3.1.5, < 3.1.8

[darakian]

Remove Microsoft.AspNetCore.App.Runtime.linux-musl-arm from the affected package list.

Do you mean Microsoft.AspNetCore.App.Runtime.linux-musl-arm64?