Fluid Attacks Database

Description

Defense in Depth update for NuGet Client

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

.NET SDK

.NET 8.0.126 SDK

.NET 8.0.420 SDK

.NET 9.0.116 SDK

.NET 9.0.313 SDK

.NET 10.0.106 SDK

.NET 10.0.202 SDK

Workarounds

N/A

References

Credit

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
nuget	nuget.commandline	>=4.9.0 <4.9.7 \|\| >=5.11.0 <5.11.7 \|\| >=6.8.0 <6.8.2 \|\| >=6.11.0 <6.11.2 \|\| >=6.12.0 <6.12.5 \|\| >=6.14.0 <6.14.3 \|\| >=7.0.0 <7.0.3 \|\| =7.3.0 \|\| >=7.3.0 <7.3.1	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
nuget	nuget.packaging	>=4.9.0 <4.9.7 \|\| >=5.11.0 <5.11.7 \|\| >=6.8.0 <6.8.2 \|\| >=6.11.0 <6.11.2 \|\| >=6.12.0 <6.12.5 \|\| >=6.14.0 <6.14.3 \|\| >=7.0.0 <7.0.3 \|\| =7.3.0 \|\| >=7.3.0 <7.3.1	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
nuget	nuget.protocol	>=4.9.0 <4.9.7 \|\| >=5.11.0 <5.11.7 \|\| >=6.8.0 <6.8.2 \|\| >=6.11.0 <6.11.2 \|\| >=6.12.0 <6.12.5 \|\| >=6.14.0 <6.14.3 \|\| >=7.0.0 <7.0.3 \|\| =7.3.0 \|\| >=7.3.0 <7.3.1	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.