PeterO.Cbor dependency needs update

[felipeprabor]

Hi,
Is there any plan to update the package PeterO.Cbor in the AWSSDK.DAX.Client?

I've got an issue because of a vulnerability in the version that is used in the latest AWSSDK.DAX.Client.
Vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2024-21909

To fix that I have manually added the latest version of PeterO.Cbor in my project, but ideally I would like to just get a new version of AWSSDK.DAX.Client with the latest.

Thanks.

[dscpinheiro]

I've reached out to the DAX team (they own the client package), will post an update when I hear back from them (for reference, the internal issue is V1246407548).

[tprsilva]

Hi,
we are also pending a fix for this vulnerability, in our case we cannot fix the issue by installing the PeterO.Cbor with the fix version, do you guys have any update on this ?

Thanks.