CODEWITHSUNDEEP
c#azureazure-pipelines
H20rider
H20rider

Reputation: 2282

Upgrade Microsoft.AspNetCore.Hosting in Project

I had a security scan saying that there was a vulnerability in Microsoft.AspNetCore.Hosting.1.0.2.nupkg

I don't see it when I look at the Manage Package solutions. Since I didn't see it, I tried to add an upgraded version and run the security scan again. But I still got a message about 1.0.2.nupkg.

Any ideas on how to solve this?

Update

Bright Ran-MSFT was correct that it was the ApplicationInsights. I was able to correct the issue by the following.

Fix

Upvotes: 0

Views: 114

Answers (1)

Bright Ran-MSFT
Bright Ran-MSFT

Reputation: 13469

This issue has been fixed on the higher version of Microsoft.AspNetCore.Hosting. https://github.com/microsoft/ApplicationInsights-dotnet/issues/1902

I tried to add an upgraded version and run the security scan again. But I still got a message about 1.0.2.nupkg.

This may be caused that there are cache of the package's old version existing on the hosted machine, and the security scan tool you are using can scan the cache of the packages.

You can try to check whether the security scan tool can list the paths of the packages it has scanned. Then you can try to find the path of the package Microsoft.AspNetCore.Hosting 1.0.2, and manually delete the cache from the path.

You also can try using the commands 'dotnet nuget locals --clear' or 'nuget locals -clear' to clear the caches.

To view more details, you can see "Managing the global packages, cache, and temp folders".

Upvotes: 1

Related Questions