[GHSA-x9vc-6hfv-hg8c] Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow

[Kritner]

Updates

• Affected products

Comments
I didn't know how else to submit a "question" about the advisory - but it looks like there were patches applied to the major revs 6 and 7 to address this vulnerability. however since the advisory lists everything below 8.0.3 as vulnerable, analyzers are still flagging patched revs of 6.0.x with the patched vulnerability (as an example)

is there a means of providing vulnerable / patched versions on a per major rev basis for the security advisory? Doing an upgrade from major rev 6 -> 8 is not necessarily feasible in the short term

[github]

Hi there @paul-gerste-sonarsource and @NinoFloris! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Kritner]

i see a similar issue has been brought up in several other suggested edits