not found vulnerabilities at bootstrap v 3.4.1

[rainmakerho]

Hi!

I am using following command,

devaudit nuget -f "C:\Labs\MyStore\Attacker.MyStore\packages.config"

packages.config

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="Antlr" version="3.5.0.2" targetFramework="net45" />
  <package id="bootstrap" version="3.4.1" targetFramework="net45" />
  <package id="jQuery" version="3.4.1" targetFramework="net45" />
  <package id="jQuery.Validation" version="1.17.0" targetFramework="net45" />
  <package id="Microsoft.AspNet.Mvc" version="5.2.7" targetFramework="net45" />
  <package id="Microsoft.AspNet.Razor" version="3.2.7" targetFramework="net45" />
  <package id="Microsoft.AspNet.Web.Optimization" version="1.1.3" targetFramework="net45" />
  <package id="Microsoft.AspNet.WebPages" version="3.2.7" targetFramework="net45" />
  <package id="Microsoft.CodeDom.Providers.DotNetCompilerPlatform" version="2.0.1" targetFramework="net45" />
  <package id="Microsoft.jQuery.Unobtrusive.Validation" version="3.2.11" targetFramework="net45" />
  <package id="Microsoft.Web.Infrastructure" version="1.0.0.0" targetFramework="net45" />
  <package id="Modernizr" version="2.8.3" targetFramework="net45" />
  <package id="Newtonsoft.Json" version="12.0.2" targetFramework="net45" />
  <package id="WebGrease" version="1.6.0" targetFramework="net45" />
</packages>

package contains bootstrap v 3.4.1
but cann't find [CVE-2018-14042] vulnerabilities.

thanks

[ken-duck]

Oh dear. We had linked this to our internal system, but when it was looked at this ticket was not updated.

Looking at the details of CVE-2018-14042, it turns out that versions 3.4.0 and greater (in the 3.4 branch) are not vulnerable, though the description claims it is. If you look at the details here you can see that the CVE agrees.

Apologies for not updating this ticket sooner. This project has not had a full time maintainer in a little while. I peek in occasionally to try and deal with critical issues, but we are working on getting a full time maintainer back again. Fingers crossed we will get there soon.