MEDIUM5.5

GHSA-3hcm-6fjc-47qq

NuGet Package Manager Tampering Vulnerability

Quick fix

GHSA-3hcm-6fjc-47qq — NuGet.Commands: upgrade to the fixed version with the command below.

dotnet add package NuGet.Commands --version 5.0.2

Details

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default `obj`), aka 'NuGet Package Manager Tampering Vulnerability'.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/NuGet.Commands

Introduced in: 5.0.0Fixed in: 5.0.2

Fixdotnet add package NuGet.Commands --version 5.0.2

References

https://nvd.nist.gov/vuln/detail/CVE-2019-0976[ADVISORY]
https://github.com/NuGet/Home/issues/7908[WEB]
https://github.com/NuGet/NuGet.Client/commit/e32a2ea7096debd3e513188f6779bb1041593326[WEB]
https://github.com/NuGet/NuGet.Client[PACKAGE]
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976[WEB]
https://web.archive.org/web/20200227075944/http://www.securityfocus.com/bid/108210[WEB]