Build errors for Gembox.Spreadsheet because of transient NuGet package vulnerability

GemBox.Spreadsheet
1

Hello, with the latest release of .NET 9 SDK there was a change to how NuGet packages get searched for vulnerabilities:

  • NuGetAudit should check transitive packages by default when the .NET 9 SDK is installed #13293

That means that at build time also the packages used by Gembox will be searched by vulnerabilities and we get the following error:
NU1902 : Package ‘BouncyCastle’ 1.8.9 has a known moderate severity vulnerability, Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. · CVE-2024-29857 · GitHub Advisory Database · GitHub
as you can see bouncy castle is only used by gembox

image
image1260×455 38.8 KB

Currently we are using this versions of gembox
PackageVersion Include=“GemBox.Spreadsheet” Version=“47.0.1398”

The problem is that BouncyCastle is no longer maintained and there is no fix for that vulnerability. So we cannot just reference a different version to override the implict version used by gembox.
The only fix they recommend is to switch to BouncyCastle.Cryptography.

The first version of Gembox.Spreadsheet that uses BouncyCastle.Cryptography for a .NET Framework 4.8 project is 49.0.1509.

Our license is bound to the version we have installed and we don’t need to upgrade now. So if you could provide a hot fix because we replaced all our transient vulnerabilities except this one.
Thanks!

2

Hi Gabriel,

What .NET Framework does your application target?

Note that BouncyCastle is a dependency of GemBox.Spreadsheet for .NET Framework 3.5 because no other package supports this version of .NET Framework.

However, GemBox.Spreadsheet for .NET Framework 4.6.2 has a dependency on BouncyCastle.Cryptography.
So, can you target version 4.6.2 or above?

Last, just as an FYI, note that we are planning to remove support for .NET Framework 3.5 in the near future.

Regards,
Mario

3

Hello Mario.

The project that references Gembox.Spreadsheet is a .NET Framework 4.7.2 project

As i said above the version of Gembox.Spreadsheet we have a license for is 47.0.1398

image
image692×417 9.07 KB

As I see here, the version 47.0.1398 has only a .NET Framework 3.5 reference and only uses BouncyCastle.

4

I see now, the hotfix you’re asking for is the version you’re probably not entitled to use because your support period has ended.
In other words, I’m afraid that to resolve this, you need to renew your license.