sboisson181332 (Community Member) asked a question.
I have multiple .NET applications where Veracode SCA warns me about high severity flaws.
According to my analysis, these issues are false positive but I would like to make sure of that. If yes, how can I put false positive for a SCA result ang get my applications pass the policy?
The first issue is for CVE-2017-0249:
One of my application is using library System.Net.WebSockets.Client.dll (v4.0.2) through a nuget package.
https://github.com/aspnet/Announcements/issues/239
It looks like the issue has been fixed in 4.0.1 so there is no flaw in 4.0.2. However Veracode does not seem to know about that fix.
The second issue is related to CVE-2020-0603:
Multiple applications are using System.Net.Http.Formatting.dll library through a nuget package. This library is detected as vulnerable by Veracode.
According to my understanding, this vulnerability affects ASP.NET Core software, so not directly the application. A patch has been provided to fix this issue on the system level and not for a specific nuget package.
I don't know why this specific library is vulnerable according to Veracode.
ps: I am not using the agent based SCA scan but the legacy one.
Thanks for your help
.png){kind=logo}
Hi @sboisson181332 (Community Member) ,
Veracode Software Composition Analysis should now detect that CVE-2017-0249 was fixed in version 4.0.1, however this version is vulnerable to other vulnerabilities and we recommend upgrading to version 4.3.2. You can find more information in our Vulnerability Database: https://sca.analysiscenter.veracode.com/vulnerability-database/security/privilege-escalation/csharp/sid-6983/summary .
If this not correctly detected, please Contact Support by clicking your avatar in the top right corner of the Community and clicking "Contact Support" and provide them with the details including a link to the results in the Veracode Platform.
CVE-2020-0603 should not apply to 'System.Net.Http.Formatting.dll' in a .NET Framework project.
If this not correctly detected, please Contact Support by clicking your avatar in the top right corner of the Community and clicking "Contact Support" and provide them with the details including a link to the results in the Veracode Platform.
Please note that if this is blocking your compliance you can mitigate Software Composition vulnerabilities (documentation here: https://help.veracode.com/reader/V_KSmNRUn6rtPwEJ1NXBmQ/7GsaZQF01ifBqF2jw0kqJQ ) and have this approved by your security team independently of Veracode.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema