Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-xxrj-7szv-s3cm
Summary
Defense in Depth update for NuGet Client
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
Aliases
0
alias GHSA-g4vj-cjjj-v7hg
Fixed_packages
0
url pkg:nuget/NuGet.Packaging@5.11.7
purl pkg:nuget/NuGet.Packaging@5.11.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@5.11.7
1
url pkg:nuget/NuGet.Packaging@6.8.2
purl pkg:nuget/NuGet.Packaging@6.8.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.8.2
2
url pkg:nuget/NuGet.Packaging@6.11.2
purl pkg:nuget/NuGet.Packaging@6.11.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.11.2
3
url pkg:nuget/NuGet.Packaging@6.12.5
purl pkg:nuget/NuGet.Packaging@6.12.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.12.5
4
url pkg:nuget/NuGet.Packaging@6.14.3
purl pkg:nuget/NuGet.Packaging@6.14.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.14.3
5
url pkg:nuget/NuGet.Packaging@7.0.3
purl pkg:nuget/NuGet.Packaging@7.0.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@7.0.3
6
url pkg:nuget/NuGet.Packaging@7.3.1
purl pkg:nuget/NuGet.Packaging@7.3.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@7.3.1
7
url pkg:nuget/NuGet.Protocol@5.11.7
purl pkg:nuget/NuGet.Protocol@5.11.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@5.11.7
8
url pkg:nuget/NuGet.Protocol@6.8.2
purl pkg:nuget/NuGet.Protocol@6.8.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.8.2
9
url pkg:nuget/NuGet.Protocol@6.11.2
purl pkg:nuget/NuGet.Protocol@6.11.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.11.2
10
url pkg:nuget/NuGet.Protocol@6.12.5
purl pkg:nuget/NuGet.Protocol@6.12.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.12.5
11
url pkg:nuget/NuGet.Protocol@6.14.3
purl pkg:nuget/NuGet.Protocol@6.14.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.14.3
12
url pkg:nuget/NuGet.Protocol@7.0.3
purl pkg:nuget/NuGet.Protocol@7.0.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@7.0.3
13
url pkg:nuget/NuGet.Protocol@7.3.1
purl pkg:nuget/NuGet.Protocol@7.3.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@7.3.1
Affected_packages
0
url pkg:nuget/NuGet.CommandLine@4.9.0
purl pkg:nuget/NuGet.CommandLine@4.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@4.9.0
1
url pkg:nuget/NuGet.CommandLine@4.9.6
purl pkg:nuget/NuGet.CommandLine@4.9.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@4.9.6
2
url pkg:nuget/NuGet.CommandLine@5.11.0
purl pkg:nuget/NuGet.CommandLine@5.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@5.11.0
3
url pkg:nuget/NuGet.CommandLine@5.11.6
purl pkg:nuget/NuGet.CommandLine@5.11.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@5.11.6
4
url pkg:nuget/NuGet.CommandLine@6.8.0
purl pkg:nuget/NuGet.CommandLine@6.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2zs5-gfxg-efgb
1
vulnerability VCID-st1x-3kvj-nfgg
2
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.8.0
5
url pkg:nuget/NuGet.CommandLine@6.8.1
purl pkg:nuget/NuGet.CommandLine@6.8.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.8.1
6
url pkg:nuget/NuGet.CommandLine@6.11.0
purl pkg:nuget/NuGet.CommandLine@6.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.11.0
7
url pkg:nuget/NuGet.CommandLine@6.11.1
purl pkg:nuget/NuGet.CommandLine@6.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.11.1
8
url pkg:nuget/NuGet.CommandLine@6.12.0
purl pkg:nuget/NuGet.CommandLine@6.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.12.0
9
url pkg:nuget/NuGet.CommandLine@6.12.4
purl pkg:nuget/NuGet.CommandLine@6.12.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.12.4
10
url pkg:nuget/NuGet.CommandLine@6.14.0
purl pkg:nuget/NuGet.CommandLine@6.14.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.14.0
11
url pkg:nuget/NuGet.CommandLine@6.14.2
purl pkg:nuget/NuGet.CommandLine@6.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@6.14.2
12
url pkg:nuget/NuGet.CommandLine@7.0.0
purl pkg:nuget/NuGet.CommandLine@7.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@7.0.0
13
url pkg:nuget/NuGet.CommandLine@7.0.2
purl pkg:nuget/NuGet.CommandLine@7.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@7.0.2
14
url pkg:nuget/NuGet.CommandLine@7.3.0
purl pkg:nuget/NuGet.CommandLine@7.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.CommandLine@7.3.0
15
url pkg:nuget/NuGet.Packaging@4.9.0
purl pkg:nuget/NuGet.Packaging@4.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@4.9.0
16
url pkg:nuget/NuGet.Packaging@4.9.6
purl pkg:nuget/NuGet.Packaging@4.9.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@4.9.6
17
url pkg:nuget/NuGet.Packaging@5.11.0
purl pkg:nuget/NuGet.Packaging@5.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2zs5-gfxg-efgb
1
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@5.11.0
18
url pkg:nuget/NuGet.Packaging@5.11.6
purl pkg:nuget/NuGet.Packaging@5.11.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@5.11.6
19
url pkg:nuget/NuGet.Packaging@6.8.0
purl pkg:nuget/NuGet.Packaging@6.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2zs5-gfxg-efgb
1
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.8.0
20
url pkg:nuget/NuGet.Packaging@6.8.1
purl pkg:nuget/NuGet.Packaging@6.8.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.8.1
21
url pkg:nuget/NuGet.Packaging@6.11.0
purl pkg:nuget/NuGet.Packaging@6.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.11.0
22
url pkg:nuget/NuGet.Packaging@6.11.1
purl pkg:nuget/NuGet.Packaging@6.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.11.1
23
url pkg:nuget/NuGet.Packaging@6.12.0
purl pkg:nuget/NuGet.Packaging@6.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.12.0
24
url pkg:nuget/NuGet.Packaging@6.12.4
purl pkg:nuget/NuGet.Packaging@6.12.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.12.4
25
url pkg:nuget/NuGet.Packaging@6.14.0
purl pkg:nuget/NuGet.Packaging@6.14.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.14.0
26
url pkg:nuget/NuGet.Packaging@6.14.2
purl pkg:nuget/NuGet.Packaging@6.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@6.14.2
27
url pkg:nuget/NuGet.Packaging@7.0.0
purl pkg:nuget/NuGet.Packaging@7.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@7.0.0
28
url pkg:nuget/NuGet.Packaging@7.0.2
purl pkg:nuget/NuGet.Packaging@7.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@7.0.2
29
url pkg:nuget/NuGet.Packaging@7.3.0
purl pkg:nuget/NuGet.Packaging@7.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Packaging@7.3.0
30
url pkg:nuget/NuGet.Protocol@4.9.0
purl pkg:nuget/NuGet.Protocol@4.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@4.9.0
31
url pkg:nuget/NuGet.Protocol@4.9.6
purl pkg:nuget/NuGet.Protocol@4.9.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@4.9.6
32
url pkg:nuget/NuGet.Protocol@5.11.0
purl pkg:nuget/NuGet.Protocol@5.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5fx1-z4cb-hyd8
1
vulnerability VCID-xxrj-7szv-s3cm
2
vulnerability VCID-yp6p-q3tf-5qb7
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@5.11.0
33
url pkg:nuget/NuGet.Protocol@5.11.6
purl pkg:nuget/NuGet.Protocol@5.11.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@5.11.6
34
url pkg:nuget/NuGet.Protocol@6.8.0
purl pkg:nuget/NuGet.Protocol@6.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.8.0
35
url pkg:nuget/NuGet.Protocol@6.8.1
purl pkg:nuget/NuGet.Protocol@6.8.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.8.1
36
url pkg:nuget/NuGet.Protocol@6.11.0
purl pkg:nuget/NuGet.Protocol@6.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.11.0
37
url pkg:nuget/NuGet.Protocol@6.11.1
purl pkg:nuget/NuGet.Protocol@6.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.11.1
38
url pkg:nuget/NuGet.Protocol@6.12.0
purl pkg:nuget/NuGet.Protocol@6.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.12.0
39
url pkg:nuget/NuGet.Protocol@6.12.4
purl pkg:nuget/NuGet.Protocol@6.12.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.12.4
40
url pkg:nuget/NuGet.Protocol@6.14.0
purl pkg:nuget/NuGet.Protocol@6.14.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.14.0
41
url pkg:nuget/NuGet.Protocol@6.14.2
purl pkg:nuget/NuGet.Protocol@6.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@6.14.2
42
url pkg:nuget/NuGet.Protocol@7.0.0
purl pkg:nuget/NuGet.Protocol@7.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@7.0.0
43
url pkg:nuget/NuGet.Protocol@7.0.2
purl pkg:nuget/NuGet.Protocol@7.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@7.0.2
44
url pkg:nuget/NuGet.Protocol@7.3.0
purl pkg:nuget/NuGet.Protocol@7.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xxrj-7szv-s3cm
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/NuGet.Protocol@7.3.0
References
0
reference_url https://github.com/NuGet/NuGet.Client
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/NuGet/NuGet.Client
1
reference_url https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-g4vj-cjjj-v7hg
reference_id
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-g4vj-cjjj-v7hg
2
reference_url https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr
3
reference_url https://github.com/advisories/GHSA-g4vj-cjjj-v7hg
reference_id GHSA-g4vj-cjjj-v7hg
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g4vj-cjjj-v7hg
Weaknesses
0
cwe_id 345
name Insufficient Verification of Data Authenticity
description The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Exploits
Severity_range_score0.1 - 3
Exploitability0.5
Weighted_severity2.7
Risk_score1.4
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-xxrj-7szv-s3cm