Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.
If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!
ProGet: Vulnerability scanning of Chocolatey feeds
-
Are Chocolatey feeds included in the vulnerability scanning in the new ProGet 2024 (currently running 2024.2)?
I pulled a sample package (.NET Core 8.0.1, package name 'dotnet'). This has some CVEs listed against it (e.g. https://www.cve.org/CVERecord?id=CVE-2024-21392), but ProGet shows 'None' under vulnerabilities.
Is this the intended behaviour or am I missing something in my configuration for this to work?
-
Chocolatey packages are scanned for viruses, so you will see those pop up. For example,
pathdebug 0.3.4should show up in ProGet's vulnerability system:
https://security.inedo.com/vulnerability/details/PGV-2420934Otherwise, there is unfortunately no standardized/consistent naming for Windows software (unlike APK, APT, RPM, etc), so there's no way to associate a vulnerability report like CVE-2024-21392 with a software package.
In this case, Microsoft calls the effected software ".NET 8.0", not
.NETordotnet, etc. In Other reports, they call it ".NET8", etc.And you can see that it translates a little weird n the CVE report as well:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21392".NET 8.0 affected from 1.0.0 before 8.0.3 " - weird, right?
This is a known issue in the industry for many years, and it would need to be address by Microsoft first. It's sadly not on their priority list.
Best,
Alana
