netstandard.library.1.6.0.nupkg: 1 vulnerabilities (highest severity is: 7.5) reachable
Repository: jgeraigery/coremltools
Author: mend-for-github-com[bot]
<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - <b>netstandard.library.1.6.0.nupkg</b></summary>
<p></p>
<p>Path to dependency file: /deps/protobuf/csharp/src/Google.Protobuf.Test/Google.Protobuf.Test.csproj</p>
<p>Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.1.0/system.net.http.4.1.0.nupkg</p>
<p>
<p>Found in HEAD commit: <a href="https://github.com/jgeraigery/coremltools/commit/cb187ac68bbd85399a27da116bd477a755448e9e">cb187ac68bbd85399a27da116bd477a755448e9e</a></p></details>
## Vulnerabilities
| Vulnerability | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (netstandard.library.1.6.0.nupkg version) | Remediation Possible** | Reachability |
| ------------- | ------------- | ----- | ----- | ----- | ----- | ----- | ------------- | --- | --- |
| [CVE-2018-8292](https://www.mend.io/vulnerability-database/CVE-2018-8292) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 6.8% | system.net.http.4.1.0.nupkg | Transitive | N/A* | ❌|<p align="center"><img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> Reachable</p> |
<p>*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.</p><p>**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation</p>
## Details
<details>
<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=19 height=20> CVE-2018-8292</summary>
### Vulnerable Library - <b>system.net.http.4.1.0.nupkg</b>
<p>Provides a programming interface for modern HTTP applications, including HTTP client components that...</p>
<p>Library home page: <a href="https://api.nuget.org/packages/system.net.http.4.1.0.nupkg">https://api.nuget.org/packages/system.net.http.4.1.0.nupkg</a></p>
<p>Path to dependency file: /deps/protobuf/csharp/src/Google.Protobuf.Test/Google.Protobuf.Test.csproj</p>
<p>Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.1.0/system.net.http.4.1.0.nupkg</p>
<p>
Dependency Hierarchy:
- netstandard.library.1.6.0.nupkg (Root Library)
- :x: **system.net.http.4.1.0.nupkg** (Vulnerable Library)
<p>Found in HEAD commit: <a href="https://github.com/jgeraigery/coremltools/commit/cb187ac68bbd85399a27da116bd477a755448e9e">cb187ac68bbd85399a27da116bd477a755448e9e</a></p>
<p>Found in base branch: <b>main</b></p>
</p>
<p></p>
### Reachability Analysis
This vulnerability is potentially reachable
```
Google.Protobuf.ProtoDump.Program (Application)
-> System.IO.File (Extension)
-> System.IO.StreamReader (Extension)
-> System.SR (Extension)
...
-> System.IO.UnmanagedMemoryStream (Extension)
-> System.Runtime.InteropServices.SafeBuffer (Extension)
-> ❌ Microsoft.Win32.SafeHandles.SafeHandleZeroOrMinusOneIsInvalid (Vulnerable Component)
```
</p>
<p></p>
### Vulnerability Details
<p>
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
<p>Publish Date: 2018-10-10
<p>URL: <a href=https://www.mend.io/vulnerability-database/CVE-2018-8292>CVE-2018-8292</a></p>
</p>
<p></p>
### Threat Assessment
<p>
<p>Exploit Maturity: Not Defined</p>
<p>EPSS: 6.8%</p>
</p>
<p></p>
### CVSS 3 Score Details (<b>7.5</b>)
<p>
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
</p>
For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.
</p>
<p></p>
### Suggested Fix
<p>
<p>Type: Upgrade version</p>
<p>Release Date: 2018-10-10</p>
<p>Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1</p>
</p>
<p></p>
</details>