Repository navigation
GHSA-846f-f764-76mx: pin patched System.Security.Cryptography.Pkcs, and Polecat 5.40.2 - #767
Merged
Merged
Conversation
…nd Polecat 5.40.2 CVE-2026-84008 (high, CVSS 7.5): SignedCms.CheckSignature can reparse attacker-controlled X.509 data quadratically. Polecat carried the vulnerable package transitively through Microsoft.Data.SqlClient 7.0.0 (Pkcs 9.0.13) on both target frameworks. Bumping SqlClient does not help: 7.1.1 still pins 9.0.18. Polecat now references System.Security.Cryptography.Pkcs directly, at 10.0.13 for net10.0 and 9.0.21 for net9.0, so the patched floor is in the published nuspec and reaches consumers. This also clears GHSA-2fmv-rv2c-59x7 (moderate) on the same package. `dotnet list package --vulnerable --include-transitive` is clean across the solution. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GHSA-846f-f764-76mx / CVE-2026-84008 (high, CVSS 7.5) is a quadratic-CPU DoS in
SignedCms.CheckSignaturein System.Security.Cryptography.Pkcs.Polecat pulls that package in transitively through Microsoft.Data.SqlClient 7.0.0, which pins Pkcs 9.0.13 (vulnerable) on both net9.0 and net10.0. That reaches
Polecat,Polecat.AspNetCoreandPolecat.EntityFrameworkCore, and from there every consumer. Upgrading SqlClient doesn't fix it: the latest release, 7.1.1, still pins 9.0.18.Change
Directory.Packages.props: one Pkcs version per target framework,10.0.13for net10.0 and9.0.21for net9.0. These are the first patched versions on each line.src/Polecat/Polecat.csproj: a directPackageReference, so the patched floor goes into the published nuspec. I checked by packing: the nuspec lists9.0.21and10.0.13in the matching framework groups.The same bump also clears GHSA-2fmv-rv2c-59x7 (moderate) on the same package.
Verification
dotnet list polecat.slnx package --vulnerable --include-transitive: before the change, all 10 projects flagged Pkcs 9.0.13 (High). After it, none of them report any vulnerable package.dotnet build polecat.slnx -c Releasesucceeds. The full test suite runs in CI.Marten and Fisher were checked the same way. Neither has this vulnerability in any shipped package.
🤖 Generated with Claude Code