BMcKeever981950 (Community Member) asked a question.
A SCA scan of a C# application flagged a vuln in a dependency System.ServiceModel.Primitives.dll. When I look at the details, Veracode recommends that I use version 4.10.2. The thing is, that is the version that the application uses, you can see it in the Component Path: packages\System.ServiceModel.Primitives.4.10.2. I think the problem is that the nuget package does contain older versions for some targets - apparently the netstandard1.1 version is an old vulnerable one, 4.0.0-beta-22231. This application doesn't target that platform, so that should be irrelevant.
What are the next steps to either remove this as a false positive or to make Veracode understand that netstandard1.1 is not relevant to this project?
.png){kind=logo}
Hello Keever,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu.Open a case with Support, for Static Analysis and provide the steps you are taking to receive that error to better help assist the engineer.Regards,
Veracode Inc.With this issue, I would recommend opening a support ticket. You can open a support ticket within the Community. Simply click on your profile on the top right side of the screen and select "Contact Support". Or click on the link below.https://community.veracode.com/s/contact-support
Regards,
Sanjay
Veracode Support