Security Advisory | Defense in Depth update for NuGet Client

[kartheekp-ms]

Security Advisory | Defense in Depth update for NuGet Client

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Discussion

Discussion for this issue can be found at NuGet/Home#14857

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

Affected versions	Patched version
>= 4.9.0, <= 4.9.6	4.9.7
>= 5.11.0, <= 5.11.6	5.11.7
>= 6.8.0, <= 6.8.1	6.8.2
>= 6.11.0, <= 6.11.1	6.11.2
>= 6.12.0, <= 6.12.4	6.12.5
>= 6.14.0, <= 6.14.2	6.14.3
>= 7.0.0, <= 7.0.2	7.0.3
7.3.0	7.3.1

GitHub Advisory

.NET SDK

• .NET 8.0.126 SDK
• .NET 8.0.420 SDK
• .NET 9.0.116 SDK
• .NET 9.0.313 SDK
• .NET 10.0.106 SDK
• .NET 10.0.202 SDK

Workarounds

N/A