ProGet: Vulnerability scanning of Chocolatey feeds

[am.infrastruktur_3111]

Are Chocolatey feeds included in the vulnerability scanning in the new ProGet 2024 (currently running 2024.2)?

I pulled a sample package (.NET Core 8.0.1, package name 'dotnet'). This has some CVEs listed against it (e.g. https://www.cve.org/CVERecord?id=CVE-2024-21392), but ProGet shows 'None' under vulnerabilities.

Is this the intended behaviour or am I missing something in my configuration for this to work?

[atripp]

Hi @am-infrastruktur_3111 ,

Chocolatey packages are scanned for viruses, so you will see those pop up. For example, pathdebug 0.3.4 should show up in ProGet's vulnerability system:
https://security.inedo.com/vulnerability/details/PGV-2420934

Otherwise, there is unfortunately no standardized/consistent naming for Windows software (unlike APK, APT, RPM, etc), so there's no way to associate a vulnerability report like CVE-2024-21392 with a software package.

In this case, Microsoft calls the effected software ".NET 8.0", not .NET or dotnet, etc. In Other reports, they call it ".NET8", etc.

And you can see that it translates a little weird n the CVE report as well:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21392

".NET 8.0 affected from 1.0.0 before 8.0.3 " - weird, right?

This is a known issue in the industry for many years, and it would need to be address by Microsoft first. It's sadly not on their priority list.

Best,
Alana