{"id":"GHSA-gpv5-rp6w-58r8","aliases":[],"status":"published","title":"Remote code execution vulnerability in dependency System.Drawing.Common","description":"### Impact\n\nThe core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.\n\nThe real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.\n\n### References\n_Are there any links users can visit to find out more?_\n\nOriginal issue: https://github.com/akkadotnet/akka.net/issues/6226\nMSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new)\n* Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-11-22T00:13:44Z","modified":"2024-12-04T05:32:04Z","fixes":[{"ecosystem":"NuGet","package":"Akka","fixed_in":["1.4.46","1.5.0-alpha3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Akka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.46"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Akka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0-alpha1"},{"fixed":"1.5.0-alpha3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Akka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.46"}]}],"versions":["0.2.0-beta","0.2.1-beta","0.5.0","0.5.2","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.7.0","0.7.1","0.8.0","1.0.0","1.0.0-dev1504032244","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.19","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.0-beta1","1.4.0-beta2","1.4.0-beta3","1.4.0-beta4","1.4.1","1.4.1-rc1","1.4.1-rc2","1.4.1-rc3","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.21-beta1","1.4.22","1.4.23","1.4.24","1.4.25","1.4.26","1.4.27","1.4.28","1.4.29","1.4.3","1.4.30","1.4.31","1.4.32","1.4.33","1.4.34","1.4.35","1.4.36","1.4.37","1.4.38","1.4.39","1.4.4","1.4.40","1.4.41","1.4.42","1.4.43","1.4.44","1.4.45","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"NuGet","package":"Akka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0-alpha1"},{"fixed":"1.5.0-alpha3"}]}],"versions":["1.5.0-alpha1","1.5.0-alpha2"]}],"references":[{"url":"https://github.com/akkadotnet/akka.net/security/advisories/GHSA-gpv5-rp6w-58r8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gpv5-rp6w-58r8"},{"url":"https://github.com/akkadotnet/akka.net","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gpv5-rp6w-58r8","title":"Remote code execution vulnerability in dependency System.Drawing.Common","description":"### Impact\n\nThe core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.\n\nThe real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.\n\n### References\n_Are there any links users can visit to find out more?_\n\nOriginal issue: https://github.com/akkadotnet/akka.net/issues/6226\nMSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new)\n* Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)\n","status":"published","published":"2022-11-22T00:13:44Z","modified":"2023-01-31T21:29:15Z","updated_at":"2026-11-02T14:36:29.957996Z"}],"osv":[{"id":"GHSA-gpv5-rp6w-58r8","title":"Remote code execution vulnerability in dependency System.Drawing.Common","description":"### Impact\n\nThe core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.\n\nThe real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.\n\n### References\n_Are there any links users can visit to find out more?_\n\nOriginal issue: https://github.com/akkadotnet/akka.net/issues/6226\nMSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new)\n* Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)\n","status":"published","published":"2022-11-22T00:13:44Z","modified":"2024-12-04T05:32:04.565831Z","updated_at":"2026-11-02T15:46:48.191583Z"}]}}