From be70c8dfe9373f47d503f0db9ed3cf329506883f Mon Sep 17 00:00:00 2001 From: Mikel Blanchard Date: Wed, 9 Oct 2024 14:04:47 -0700 Subject: [PATCH 1/2] Mitigate STJ vulnerabilities in projects targeting 6.0.0. --- build/Common.props | 13 ++++++++---- build/Common.targets | 20 +++++++++++++++++++ .../CHANGELOG.md | 5 +++++ ...OpenTelemetry.Exporter.OneCollector.csproj | 4 ++-- src/OpenTelemetry.Resources.AWS/CHANGELOG.md | 5 +++++ .../OpenTelemetry.Resources.AWS.csproj | 2 +- 6 files changed, 42 insertions(+), 7 deletions(-) diff --git a/build/Common.props b/build/Common.props index 9a5fbde756..d224b292ad 100644 --- a/build/Common.props +++ b/build/Common.props @@ -35,8 +35,8 @@ [5.0.0,6.0) [8.0.1,) [2.1.0,5.0) - 8.0.0 - 8.0.0 + [8.0.0,) + [8.0.0,) [1.0.3,2.0) [4.2.2,5.0) [3.11.0-beta1.23525.2] @@ -49,8 +49,13 @@ [3.16.0,4.0) [1.2.0-beta.556,2.0) [4.3.4,) - 4.7.0 - [6.0.0,) + [4.7.0,) + + + [4.7.2,) + [4.7.2,) + [6.0.10,) + [8.0.5,) diff --git a/build/Common.targets b/build/Common.targets index faf2349bae..97495b2300 100644 --- a/build/Common.targets +++ b/build/Common.targets @@ -1,3 +1,23 @@ + + + + + + + + diff --git a/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md b/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md index 79451efd20..1a970c0d17 100644 --- a/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md +++ b/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md @@ -5,6 +5,11 @@ * Drop support for .NET 6 as this target is no longer supported. ([#2123](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/2123)) +* Bumped `System.Text.Json` reference to `6.0.10` for runtimes older than + `net8.0` and bumped to `8.0.5` on `net8.0` in response to + [CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485). + ([#XXXX](https://github.com/open-telemetry/opentelemetry-dotnet/pull/XXXX)) + ## 1.10.0-alpha.1 Released 2024-Sep-06 diff --git a/src/OpenTelemetry.Exporter.OneCollector/OpenTelemetry.Exporter.OneCollector.csproj b/src/OpenTelemetry.Exporter.OneCollector/OpenTelemetry.Exporter.OneCollector.csproj index 111cb4960c..a1efbd7490 100644 --- a/src/OpenTelemetry.Exporter.OneCollector/OpenTelemetry.Exporter.OneCollector.csproj +++ b/src/OpenTelemetry.Exporter.OneCollector/OpenTelemetry.Exporter.OneCollector.csproj @@ -14,6 +14,7 @@ in the future (hopefully .NET 9) see https://github.com/dotnet/runtime/issues/92509 --> $(NoWarn);SYSLIB1100;SYSLIB1101 1.9.2 + $(SystemTextJsonLatestNet6OutOfBandPkgVer) @@ -23,12 +24,11 @@ - - + diff --git a/src/OpenTelemetry.Resources.AWS/CHANGELOG.md b/src/OpenTelemetry.Resources.AWS/CHANGELOG.md index 96cd089d1b..ea1cfe40d1 100644 --- a/src/OpenTelemetry.Resources.AWS/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.AWS/CHANGELOG.md @@ -9,6 +9,11 @@ and add .NET Standard 2.0 target. ([#2164](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/2164)) +* Bumped `System.Text.Json` reference to `6.0.10` for runtimes older than + `net8.0` and bumped to `8.0.5` on `net8.0` in response to + [CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485). + ([#XXXX](https://github.com/open-telemetry/opentelemetry-dotnet/pull/XXXX)) + ## 1.5.0-beta.1 Released 2024-Jun-04 diff --git a/src/OpenTelemetry.Resources.AWS/OpenTelemetry.Resources.AWS.csproj b/src/OpenTelemetry.Resources.AWS/OpenTelemetry.Resources.AWS.csproj index acfae6f7c4..1484689837 100644 --- a/src/OpenTelemetry.Resources.AWS/OpenTelemetry.Resources.AWS.csproj +++ b/src/OpenTelemetry.Resources.AWS/OpenTelemetry.Resources.AWS.csproj @@ -6,6 +6,7 @@ $(TargetFrameworks);$(NetFrameworkMinimumSupportedVersion) OpenTelemetry Resource Detectors for AWS ElasticBeanstalk, EC2, ECS, EKS. Resources.AWS- + $(SystemTextJsonLatestNet6OutOfBandPkgVer)