You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
During some our static scanning we have been seeing the following that's traceable to dependencies in this package.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS).
The serialization and deserialization path have different properties regarding the issue.
Seems like the recommendation is to update to a more recent version of Newtonsoft and do as described:
To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set MaxDepth parameter in the JsonSerializerSettings. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with Newtonsoft.Json.JsonReaderException:
Wondering if this is on your radar to address?
Current version 16.0.0 .Net
The text was updated successfully, but these errors were encountered:
During some our static scanning we have been seeing the following that's traceable to dependencies in this package.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS).
The serialization and deserialization path have different properties regarding the issue.
Seems like the recommendation is to update to a more recent version of Newtonsoft and do as described:
To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set MaxDepth parameter in the JsonSerializerSettings. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with Newtonsoft.Json.JsonReaderException:
Wondering if this is on your radar to address?
Current version 16.0.0 .Net
The text was updated successfully, but these errors were encountered: