Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-gpv5-rp6w-58r8
No affected components available
Impact
The core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.
The real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.
Patches
Has the problem been patched? What versions should users upgrade to?
This issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
You might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.
References
Are there any links users can visit to find out more?
Original issue: https://github.com/akkadotnet/akka.net/issues/6226 MSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Akka.NET repository
- Contact us on the Akka.NET Discord
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard