All pre-8.0.3 version NuGet packages are shown as vulnerable whereas more versions are listed as patched on the Security issue

[dsparkplug]

The CVE-2024-32655 advisory shows affected versions as <= 8.0.2 and all the NuGet packages for these versions are marked as vulnerable.

SQL Injection via Protocol Message Size Overflow however says that versions 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7 and 8.0.3 are all patched.

Which source is the truth?

[cjlotz]

Same issue on our side. Not sure if it is possible to update the advisory/add new advisory items to indicate the patched versions for the older releases as well to prevent compilation warnings for older releases that will not update to 8.0.3

[RobH-CL]

It looks like there's already a PR to update the advisory:

• [GHSA-x9vc-6hfv-hg8c] Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow github/advisory-database#4379

And several more:

• [GHSA-x9vc-6hfv-hg8c] Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow github/advisory-database#4380
• [GHSA-x9vc-6hfv-hg8c] Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow github/advisory-database#4381
• [GHSA-x9vc-6hfv-hg8c] Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow github/advisory-database#4382
• [GHSA-x9vc-6hfv-hg8c] Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow github/advisory-database#4382

[roji]

We indeed backported the fix to all Npgsql versions going back to 4.0, so GHSA-x9vc-6hfv-hg8c is correct. We've submitted github/advisory-database#4379 to amend the advisory that was mistakenly pushed without that information - hopefully that gets merged soon.

[seantleonard]

As a comment also mentioned in the merged PR:
github/advisory-database#4379 (comment)

Just awaiting these updates to propagate wherever they need to go. Running dotnet format -v d in GitHub Actions when treating warnings as error still shows NU1903 when restoring packages:

error NU1903: Warning As Error: Package 'Npgsql' 7.0.7 has a known high severity vulnerability, GHSA-x9vc-6hfv-hg8c

[Brar]

Closing this as github/advisory-database#4379 has been merged and the affected and patched versions at GHSA-x9vc-6hfv-hg8c are now correct.