[ASP.NET Core] Fix System.Text.Encodings.Web vulnerability (#4399)

open-telemetry · Apr 19, 2023 · bfb3e45 · bfb3e45
1 parent 586aa7e
commit bfb3e45
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+* Added direct reference to `System.Text.Encodings.Web` with minimum version of
+`4.7.2` due to [CVE-2021-26701](https://github.com/dotnet/runtime/issues/49377).
+This impacts target frameworks `netstandard2.0` and `netstandard2.1` which has a
+reference to `Microsoft.AspNetCore.Http.Abstractions` that depends on
+`System.Text.Encodings.Web` >= 4.5.0.
+([#4399](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4399))
+
 * Improve perf by avoiding boxing of common status codes values.
   ([#4360](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4360),
   [#4363](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4363))

diff --git a/src/OpenTelemetry.Instrumentation.AspNetCore/OpenTelemetry.Instrumentation.AspNetCore.csproj b/src/OpenTelemetry.Instrumentation.AspNetCore/OpenTelemetry.Instrumentation.AspNetCore.csproj
@@ -21,11 +21,13 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
+    <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="$(MicrosoftAspNetCoreHttpAbstractionsPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Features" Version="$(MicrosoftAspNetCoreHttpFeaturesPkgVer)" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.1'">
+    <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="$(MicrosoftAspNetCoreHttpAbstractionsPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Features" Version="$(MicrosoftAspNetCoreHttpFeaturesPkgVer)" />
   </ItemGroup>