Bump MongoDB.Driver from 2.13.1 to 2.15.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0 by eddynaka · Pull Request #608 · microsoft/sarif-pattern-matcher

eddynaka · 2022-04-11T16:41:05Z

Changes

This change will fix the following issues:

Bump MongoDB.Driver from 2.13.1 to 2.15.0: fixes https://nvd.nist.gov/vuln/detail/CVE-2021-39208
Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0: fixes https://nvd.nist.gov/vuln/detail/CVE-2020-1045

As you can see, you cannot see Microsoft.AspNetCore.Http version 2.1.0 in the changes because it is a reference from the package Microsoft.NET.Sdk.Functions -> Microsoft.Azure.WebJobs.Extensions.Http -> Microsoft.AspNetCore.Http

For significant contributions please make sure you have completed the following items:

ReleaseHistory.md updated for non-trivial changes
Added unit tests

eddynaka · 2022-04-11T16:41:39Z

-#  inputs:
-#    targetPath: bld/bin/AnyCPU_Debug/Tests.Security/netcoreapp3.1/
-#    artifactName: Tests.Security
+- task: ComponentGovernanceComponentDetection@0


ComponentGovernanceComponentDetection@0

this will guarantee that ComponentGovernance can always track this repository

eddynaka · 2022-04-11T16:42:08Z

    <PackageReference Include="GoogleApi" Version="4.0.4" />
    <PackageReference Include="Microsoft.Security.Utilities" Version="1.1.0" />
-    <PackageReference Include="MongoDB.Driver" Version="2.13.1" />
+    <PackageReference Include="MongoDB.Driver" Version="2.15.0" />


2.15.0

Version 2.15.0 contains the updated version of SharpCompress (0.30.1), which does not have a vulnerability.

eddynaka · 2022-04-11T16:43:22Z

    <None Remove="Properties\PublishProfiles\**" />
  </ItemGroup>
  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.2.2" />


2.2.2

2.2.2 contains a fix for the vulnerability found in 2.1.0:
https://access.redhat.com/security/cve/CVE-2020-1045

there are no release notes for the PR, which is customer impacting, potentially, because runtime components are changing.

Just updated and added some detail in the description

michaelcfanning

🕐

michaelcfanning · 2022-04-11T20:50:31Z


+## Unreleased
+
+- Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0. [#608](https://github.com/microsoft/sarif-pattern-matcher/pull/608)


2.13.2

this version is wrong, s/be 2.13.1 #Closed

michaelcfanning · 2022-04-11T20:50:50Z


+## Unreleased
+
+- Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0. [#608](https://github.com/microsoft/sarif-pattern-matcher/pull/608)


14

version is wrong #Closed

fixed.
I mistakenly used the version of ElfSharp (it was in my head).

cfaucon · 2022-04-12T20:49:16Z


+## Unreleased
+
+- Bump MongoDB.Driver from 2.13.1 to 2.15.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0. [#608](https://github.com/microsoft/sarif-pattern-matcher/pull/608)


Do we have existing tests in both the security project and spam function that exercise a code path that will leverage these dependencies? i.e. will we know if somehow we break ourselves due to any binding or other runtime behaviors. #Closed

for the mongodb package, we have an end-to-end test
for the http package, its the azure function. I was able to run and debug.

actually, our mongodb validator is disabled due to not being signed. so, we won't face any impact.

cfaucon · 2022-04-12T20:59:15Z


+## Unreleased
+
+- Bump MongoDB.Driver from 2.13.1 to 2.15.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0. [#608](https://github.com/microsoft/sarif-pattern-matcher/pull/608)


Should the CVEs be linked here? I notice most all release line items are very factual and explain just the change and not rationale as to the why. If that is intended I suppose CVEs don't need to be historically captured here.

One of my first iterations I had added, then I removed to simplify and added this to the PR.

The rationale: you as a customer who is using will only see the release notes if you face a problem. For things like vulnerabilities, I think you wouldn't come, so, it's why I omitted in the end.

cfaucon

michaelcfanning

eddynaka added 3 commits April 11, 2022 09:20

Updating MongoDB package

61d86f5

Fixing yml pipeline

3e4cfef

Updating package

fad4e99

eddynaka requested a review from michaelcfanning as a code owner April 11, 2022 16:41

eddynaka commented Apr 11, 2022

View reviewed changes

michaelcfanning requested changes Apr 11, 2022

View reviewed changes

eddynaka added 2 commits April 11, 2022 10:22

Adding release notes entry about update of the packages

2b3fdd6

Updating rekease history

71ef05f

eddynaka changed the title ~~Fixing component governance issues~~ Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http package from 2.1.0 to 2.2.0 Apr 11, 2022

eddynaka changed the title ~~Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http package from 2.1.0 to 2.2.0~~ Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0 Apr 11, 2022

Updating release history

6efa006

michaelcfanning reviewed Apr 11, 2022

View reviewed changes

eddynaka changed the title ~~Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0~~ Bump MongoDB.Driver from 2.13.1 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0 Apr 11, 2022

Update ReleaseHistory.md

a3a39d1

eddynaka changed the title ~~Bump MongoDB.Driver from 2.13.1 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0~~ Bump MongoDB.Driver from 2.13.1 to 2.15.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0 Apr 11, 2022

Merge branch 'main' into bump-mongodb-package

33cc197

cfaucon reviewed Apr 12, 2022

View reviewed changes

cfaucon approved these changes Apr 12, 2022

View reviewed changes

michaelcfanning approved these changes Apr 14, 2022

View reviewed changes

michaelcfanning merged commit 1cb6486 into main Apr 14, 2022

eddynaka mentioned this pull request Apr 14, 2022

Updating sarif-pattern-matcher submodules to fix component governance issues microsoft/sarif-visualstudio-extension#474

Merged

eddynaka deleted the bump-mongodb-package branch April 28, 2022 21:59


		## Unreleased

		- Bump MongoDB.Driver from 2.13.2 to 2.14.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0. [#608](https://github.com/microsoft/sarif-pattern-matcher/pull/608)


		## Unreleased

		- Bump MongoDB.Driver from 2.13.1 to 2.15.0 and Microsoft.AspNetCore.Http from 2.1.0 to 2.2.0. [#608](https://github.com/microsoft/sarif-pattern-matcher/pull/608)

Conversation

eddynaka commented Apr 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eddynaka Apr 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelcfanning left a comment

Choose a reason for hiding this comment

Uh oh!

michaelcfanning Apr 11, 2022 • edited by eddynaka Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelcfanning Apr 11, 2022 • edited by eddynaka Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cfaucon Apr 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cfaucon Apr 12, 2022 • edited by eddynaka Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cfaucon left a comment

Choose a reason for hiding this comment

Uh oh!

michaelcfanning left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eddynaka commented Apr 11, 2022 •

edited

Loading

eddynaka Apr 11, 2022 •

edited

Loading

michaelcfanning Apr 11, 2022 •

edited by eddynaka

Loading

michaelcfanning Apr 11, 2022 •

edited by eddynaka

Loading

cfaucon Apr 12, 2022 •

edited

Loading

cfaucon Apr 12, 2022 •

edited by eddynaka

Loading