GHSA-gpv5-rp6w-58r8: Akka Remote Code Execution Vulnerability

MODERATE
Share
Published
Advisory Summary

GHSA-gpv5-rp6w-58r8 is a MODERATE remote code execution vulnerability (General Security Weakness) affecting Akka libraries in the NuGet ecosystem. The issue involves remote code execution vulnerability in dependency system.drawing.common. Remediation is available by upgrading affected packages to version 1.4.46, 1.5.0-alpha3.

GHSA-gpv5-rp6w-58r8 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-gpv5-rp6w-58r8
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Akka
Package Ecosystem NuGet
Published Date
Last Updated

How to Fix GHSA-gpv5-rp6w-58r8

To remediate this vulnerability, upgrade all affected Akka dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Akka fixed: 1.4.46 
Upgrade Akka to 1.4.46
Akka fixed: 1.5.0-alpha3 
Upgrade Akka to 1.5.0-alpha3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for Akka

How to Check if You Are Affected

To determine whether your application is affected by GHSA-gpv5-rp6w-58r8, inspect your project dependencies for Akka:

inspect dependencies for Akka

Analyze the terminal output to locate any version of Akka in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.46), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Akka, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28. The real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET. ### Patches _Has the problem been patched? What versions should users upgrade to?_ This issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ You might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself. ### References _Are there any links users can visit to find out more?_ Original issue: https://github.com/akkadotnet/akka.net/issues/6226 MSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28 ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new) * Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)

GHSA-gpv5-rp6w-58r8 Affected Akka Versions

2 component(s)
Fixed Versions:
1.4.461.5.0-alpha3
Product / Package Ecosystem Affected Versions Fixed Version
Akka
nuget/Akka
NuGet
< 1.4.46
1.4.46
Akka
nuget/Akka
NuGet
≥ 1.5.0-alpha1
< 1.5.0-alpha3
1.5.0-alpha3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/akkadotnet/akka.net/security/advisories/GHSA-gpv5-rp6w-58r8
Akka Source Repository REPOSITORY
https://github.com/akkadotnet/akka.net

Frequently Asked Questions

What is GHSA-gpv5-rp6w-58r8?
GHSA-gpv5-rp6w-58r8 is a security vulnerability in Akka involving Remote code execution vulnerability in dependency System.Drawing.Common under General Security Weakness.
Which Akka versions are affected?
Affected versions include releases prior to 1.4.46, 1.5.0-alpha3 across affected packages: Akka.
What version fixes GHSA-gpv5-rp6w-58r8?
Upgrading to 1.4.46, 1.5.0-alpha3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is Akka affected?
Yes, Akka is affected in releases prior to 1.4.46, 1.5.0-alpha3. Upgrade your dependency to 1.4.46, 1.5.0-alpha3 or later.
What CWE is associated with GHSA-gpv5-rp6w-58r8?
GHSA-gpv5-rp6w-58r8 is classified under General Security Weakness.
How can I check NuGet dependencies for GHSA-gpv5-rp6w-58r8?
Run the dependency tree command: 'inspect dependencies for Akka'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gpv5-rp6w-58r8",
  "modified" : "2022-11-22T00:13:44Z",
  "published" : "2022-11-22T00:13:44Z",
  "aliases" : [ ],
  "summary" : "Remote code execution vulnerability in dependency System.Drawing.Common",
  "details" : "### Impact\n\nThe core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.\n\nThe real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThis issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.\n\n### References\n_Are there any links users can visit to find out more?_\n\nOriginal issue: https://github.com/akkadotnet/akka.net/issues/6226\nMSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new)\n* Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Akka"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.4.46"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Akka"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5.0-alpha1"
      }, {
        "fixed" : "1.5.0-alpha3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/akkadotnet/akka.net/security/advisories/GHSA-gpv5-rp6w-58r8"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/akkadotnet/akka.net"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-11-22T00:13:44Z",
    "nvd_published_at" : null
  }
}