deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-98cp-rj9f-6v5g
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-121: Stack-based Buffer Overflow
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

Details:
The patch for GHSA-7h7q-j33q-hvpf was incomplete and still allows a stack buffer overflow for the multi frame images.
GitHub Security Advisory: GHSA-98cp-rj9f-6v5g
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-121: Stack-based Buffer Overflow
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

Details:
The patch for GHSA-7h7q-j33q-hvpf was incomplete and still allows a stack buffer overflow for the multi frame images.
GitHub Security Advisory: GHSA-98cp-rj9f-6v5g
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-121: Stack-based Buffer Overflow
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

Details:
The patch for GHSA-7h7q-j33q-hvpf was incomplete and still allows a stack buffer overflow for the multi frame images.
GitHub Security Advisory: GHSA-98cp-rj9f-6v5g
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-121: Stack-based Buffer Overflow
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

Details:
The patch for GHSA-7h7q-j33q-hvpf was incomplete and still allows a stack buffer overflow for the multi frame images.
GitHub Security Advisory: GHSA-gvvw-8j96-8g5r
Package: Microsoft.Native.Quic.MsQuic.OpenSSL (NUGET)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-191: Integer Underflow (Wrap or Wraparound)
Vulnerable versions: < 2.4.18
Patched in: 2.4.18

Summary: MsQuic has a Remote Elevation of Privilege Vulnerability

Details:
### Summary
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

### Details
 Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

#### Patches
- Fix underflow in ACK frame parsing - 1e6e999b

### Impact
An attacker who successfully exploited this vulnerability could gain elevated privileges.
GitHub Security Advisory: GHSA-gvvw-8j96-8g5r
Package: Microsoft.Native.Quic.MsQuic.Schannel (NUGET)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-191: Integer Underflow (Wrap or Wraparound)
Vulnerable versions: < 2.4.18
Patched in: 2.4.18

Summary: MsQuic has a Remote Elevation of Privilege Vulnerability

Details:
### Summary
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

### Details
 Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

#### Patches
- Fix underflow in ACK frame parsing - 1e6e999b

### Impact
An attacker who successfully exploited this vulnerability could gain elevated privileges.
GitHub Security Advisory: GHSA-gvvw-8j96-8g5r
Package: Microsoft.Native.Quic.MsQuic.Schannel (NUGET)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-191: Integer Underflow (Wrap or Wraparound)
Vulnerable versions: >= 2.5.0-ci.532574, < 2.5.7
Patched in: 2.5.7

Summary: MsQuic has a Remote Elevation of Privilege Vulnerability

Details:
### Summary
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

### Details
 Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

#### Patches
- Fix underflow in ACK frame parsing - 1e6e999b

### Impact
An attacker who successfully exploited this vulnerability could gain elevated privileges.
GitHub Security Advisory: GHSA-gvvw-8j96-8g5r
Package: Microsoft.Native.Quic.MsQuic.OpenSSL (NUGET)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-191: Integer Underflow (Wrap or Wraparound)
Vulnerable versions: >= 2.5.0-ci.532574, < 2.5.7
Patched in: 2.5.7

Summary: MsQuic has a Remote Elevation of Privilege Vulnerability

Details:
### Summary
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

### Details
 Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

#### Patches
- Fix underflow in ACK frame parsing - 1e6e999b

### Impact
An attacker who successfully exploited this vulnerability could gain elevated privileges.
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: = 7.3.0
Patched in: 7.3.1

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 7.0.0, <= 7.0.2
Patched in: 7.0.3

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.14.0, <= 6.14.2
Patched in: 6.14.3

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.12.0, <= 6.12.4
Patched in: 6.12.5

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.11.0, <= 6.11.1
Patched in: 6.11.2

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.8.0, <= 6.8.1
Patched in: 6.8.2

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 5.11.0, <= 5.11.6
Patched in: 5.11.7

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.CommandLine (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 4.9.0, <= 4.9.6
Patched in: 4.9.7

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: = 7.3.0
Patched in: 7.3.1

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 7.0.0, <= 7.0.2
Patched in: 7.0.3

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.14.0, <= 6.14.2
Patched in: 6.14.3

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.12.0, <= 6.12.4
Patched in: 6.12.5

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.11.0, <= 6.11.1
Patched in: 6.11.2

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.8.0, <= 6.8.1
Patched in: 6.8.2

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 5.11.0, <= 5.11.6
Patched in: 5.11.7

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Protocol (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 4.9.0, <= 4.9.6
Patched in: 4.9.7

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: = 7.3.0
Patched in: 7.3.1

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)