Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. Insecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration information. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/518 CVSS Details - Version: 3.1 - Severity: High - Score: 7.3 - Vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L` - Weakness: CWE-532 (Insertion of Sensitive Information into Log File) - MSRC severity: Important - Impact: Information Disclosure Affected Platforms - Platforms: Linux, macOS - Architectures: x64, Arm64 Affected Packages Standalone Aspire CLI Package | Affected version | Patched version --- | --- | --- Aspire CLI (Aspire.Cli) | >= 13.2.0, =…
Recommended action: Upgrade to 13.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. An insecure temporary directory used by Aspire CLI-generated builds can allow a local attacker to influence MSBuild response-file discovery and execute code with the privileges of the developer running the CLI. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/519 CVSS Details - Version: 3.1 - Severity: High - Score: 7.3 - Vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H` - Weakness: CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) - MSRC severity: Important Affected Platforms - Platforms: Linux, macOS - Architectures: x64, Arm64 Affected Packages Standalone Aspire CLI Package | Affected version | Patched version --- | --- | ---…
Recommended action: Upgrade to 13.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.