System.Drawing.Common 4.7.0

GroupDocs.Assembly Product Family
1

Hi!
We are using version 23.8.0 of GroupDocs.Assembly for dotnet (NuGet Gallery | GroupDocs.Assembly 23.8.0). That package reference System.Drawing.Common 4.7.0 which has a critical security vulnerability.

https://nvd.nist.gov/vuln/detail/CVE-2021-24112

How can we mitigate this ? Can you update your package with a newer version? Or can we reference a newer version to our project?

Best regards
Oskar

2

@oskarj
We have opened the following new ticket(s) in our internal issue tracking system and will deliver their fixes according to the terms mentioned in Free Support Policies.

Issue ID(s): ASSEMBLYNET-11

You can obtain Paid Support Services if you need support on a priority basis, along with the direct access to our Paid Support management team.

3

Hi! Any updates regarding this? It must be in your best interest since it’s flagged as a criticial security vulnerability and might be an issue for all your customers running .NET on linux.

//Oskar

1 Like
4

@oskarj

This ticket is already under investigation. We’ll keep you posted in case of any update.

5

Any updates on this? We are about to renew our license but as long as this is not fixed we will wait.

6

@oskarj

We are already investigating this issue. You’ll be notified about the outcomes ASAP.

7

@oskarj

This issue is now resolved in API version 24.6.