[rel/17.6] Downgrade Nuget.Frameworks to 6.5.0

[nohwnd]

Downgrade Nuget.Frameworks to 6.5.0, because dotnet SDK ships with nuget version 6.6.0-preview.3 which contains 6.6.0.61, but we upgraded to 6.6.0 which requires 6.6.0.62. During build SDK will replace our version with the newest one to keep us up to date, but this time we got ahead of it and this breaks the insertion.

https://github.com/dotnet/sdk/runs/13951675455

> C:\h\w\B8C009BA\p\d\dotnet.exe msbuild /t:Restore C:\h\w\B8C009BA\t\dotnetSdkTests\th1jboi0.34o\82fd8ac8-1635---0705B68C\VSTestCore.csproj
MSBuild version 17.6.3+07e294721 for .NET
  Determining projects to restore...
  Restored C:\h\w\B8C009BA\t\dotnetSdkTests\th1jboi0.34o\82fd8ac8-1635---0705B68C\VSTestCore.csproj (in 540 ms).
> C:\h\w\B8C009BA\p\d\dotnet.exe test --results-directory C:\h\w\B8C009BA\t\dotnetSdkTests\th1jboi0.34o\82fd8ac8-1635---0705B68C\flag-dir///
  Determining projects to restore...
  All projects are up-to-date for restore.
  VSTestCore -> C:\h\w\B8C009BA\t\dotnetSdkTests\th1jboi0.34o\82fd8ac8-1635---0705B68C\bin\Debug\net7.0\VSTestCore.dll
Test run for C:\h\w\B8C009BA\t\dotnetSdkTests\th1jboi0.34o\82fd8ac8-1635---0705B68C\bin\Debug\net7.0\VSTestCore.dll (.NETCoreApp,Version=v7.0)
Microsoft (R) Test Execution Command Line Tool Version 17.6.1 (x64)
Copyright (c) Microsoft Corporation.  All rights reserved.

StdErr:
Unhandled exception. System.TypeInitializationException: The type initializer for 'Microsoft.VisualStudio.TestPlatform.ObjectModel.Framework' threw an exception.
 ---> System.IO.FileNotFoundException: Could not load file or assembly 'NuGet.Frameworks, Version=6.6.0.62, Culture=neutral, PublicKeyToken=31bf3856ad364e35'. The system cannot find the file specified.
File name: 'NuGet.Frameworks, Version=6.6.0.62, Culture=neutral, PublicKeyToken=31bf3856ad364e35'
   at Microsoft.VisualStudio.TestPlatform.ObjectModel.Framework.FromString(String frameworkString)
   at Microsoft.VisualStudio.TestPlatform.ObjectModel.Framework..cctor()
   --- End of inner exception stack trace ---
   at Microsoft.VisualStudio.TestPlatform.ObjectModel.Framework.get_DefaultFramework()
   at Microsoft.VisualStudio.TestPlatform.Common.Utilities.RunSettingsProviderExtensions.AddDefaultRunSettings(String runSettings)
   at Microsoft.VisualStudio.TestPlatform.Common.Utilities.RunSettingsProviderExtensions.AddDefaultRunSettings(IRunSettingsProvider runSettingsProvider)
   at Microsoft.VisualStudio.TestPlatform.CommandLine.Executor.GetArgumentProcessors(String[] args, List`1& processors)
   at Microsoft.VisualStudio.TestPlatform.CommandLine.Executor.Execute(String[] args)
   at Microsoft.VisualStudio.TestPlatform.CommandLine.Program.Run(String[] args, UiLanguageOverride uiLanguageOverride)
   at Microsoft.VisualStudio.TestPlatform.CommandLine.Program.Main(String[] args)
Exit Code: 1

[GianniKoch]

Hi @nohwnd , while building a project using the "Microsoft.NET.Test.Sdk" dependency on version 17.7.2 our security scanner picked up a CVE-2022-30184 vulnerability. Caused by "NuGet.Frameworks.dll". After some more digging we found that "Microsoft.TestPlatform.ObjectModel" was still using the 6.5.0 version instead of 6.6.0 ( Version that was discussed #4409 ) and so we found this PR.

[nohwnd]

@GianniKoch I am a bit confused here, please help me clarify. The CVE you link requires update to 6.2.0 or newer. We updated to 6.6.0, but that caused issued in dotnet/sdk because we were trying to ship with dependency that is too new. Normally dotnet/sdk "forces" a version into our shipment ot keep us more updated, but this time we were updating more aggressively than them.

So in this PR I've downgraded to 6.5.0, but that is still newer than 6.2.0 that the CVE requires.

What am I overlooking?

[GianniKoch]

@nohwnd apologies, I think I messed up versions myself and got confused. 6.2.0 does indeed resolve that. However, the scanner finds this vulnerability, CVE-2023-29337, on version 6.5.0.