cisagov/cset

.NET 7 reached end-of-life on 14 May 2024

enriquejavier opened this issue · 2 comments

enriquejavier commented

Microsoft .NET Core 7 and ASP.NET Core 7 reached end-of-life on 14 May 2024 (https://dotnet.microsoft.com/en-us/download/dotnet/7.0); the lack of support implies that Microsoft will no longer release new security patches for the product, which may result in security vulnerabilities.

What is the plan to update CSET to use a supported .NET runtime and ASP.NET?

Risk Information
CVSS v2 Severity: Critical
CVSS v2 Base Score: 10.0
CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3 Base Score: 10.0
CVSS v3 Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploit Information
Exploit Available: No

randywoods commented

The next release of CSET will run on .NET 8. Due to be released very soon.

mckenziewillmore commented

This is resolved in the latest release of CSET. Please update to version 12.2.