GHSA-75p2-hgw4-g7f7
AutoUpdater.NET allows XXE
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | Autoupdater.NET.Official | < 1.5.8 | 1.5.8 |
Details
As written in the advisory (Markdown source, shown as plain text).
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-20627
- https://github.com/ravibpatel/AutoUpdater.NET/commit/1dc25f2bea6ea522dbac1512b5563c4746d539c3
- https://github.com/ravibpatel/AutoUpdater.NET
- https://github.com/ravibpatel/AutoUpdater.NET/releases/tag/v1.5.8
- https://www.doyler.net/security-not-included/autoupdater-net-vulnerability