GHSA-w4x6-hh3x-wjrx: Gsemac.Net Stale Copy Of The Public Vulnerability

LOW
Share
Published
Advisory Summary

GHSA-w4x6-hh3x-wjrx is a LOW stale copy of the public vulnerability (General Security Weakness) affecting Gsemac.Net libraries in the NuGet ecosystem. The issue involves stale copy of the public suffix list. Remediation is available by upgrading affected packages to version 0.38.2.

GHSA-w4x6-hh3x-wjrx at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-w4x6-hh3x-wjrx
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Gsemac.Net
Package Ecosystem NuGet
Published Date
Last Updated

How to Fix GHSA-w4x6-hh3x-wjrx

To remediate this vulnerability, upgrade all affected Gsemac.Net dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Gsemac.Net fixed: 0.38.2 
Upgrade Gsemac.Net to 0.38.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for Gsemac.Net

How to Check if You Are Affected

To determine whether your application is affected by GHSA-w4x6-hh3x-wjrx, inspect your project dependencies for Gsemac.Net:

inspect dependencies for Gsemac.Net

Analyze the terminal output to locate any version of Gsemac.Net in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.38.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Gsemac.Net, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

We have identified that this project contains an out-of-date version of the Public Suffix List (https://publicsuffix.org/). We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences and journals. Our results will become publicly available after 21 days; this provides time to update your project with an up-to-date version of the Public Suffix List. GitHub repository: gsemac/Gsemac.Common Public Suffix List path: src/Gsemac.Net/Resources/public_suffix_list.dat The Public Suffix List is regularly updated (generally a few times per week), and to ensure that the correct privacy boundaries are maintained between websites, applications that use it should routinely fetch an updated copy. If new suffixes are added to the list, and an old list is then used, privacy boundaries will not be constructed correctly, allowing for data (e.g., cookies) to be set incorrectly, potentially harming privacy. There is further guidance on how the Public Suffix List should be used in ICANN’s “Advisory on the Use of Static TLD / Suffix Lists” at https://www.icann.org/en/system/files/files/sac-070-en.pdf. If you have any questions about our research, or about usage of the Public Suffix List, please reply via e-mail to [sm@smcquistin.uk](mailto:sm@smcquistin.uk).

GHSA-w4x6-hh3x-wjrx Affected Gsemac.Net Versions

1 component(s)
Fixed Versions:
0.38.2
Product / Package Ecosystem Affected Versions Fixed Version
Gsemac.Net
nuget/Gsemac.Net
NuGet
< 0.38.2
0.38.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/gsemac/Gsemac.Common/security/advisories/GHSA-w4x6-hh3x-wjrx
Security Fix Commit FIX COMMIT
https://github.com/gsemac/Gsemac.Common/commit/e53d203fe1274c8ea6dbb74a6b86f1635cef41bc
Gsemac.Net Source Repository REPOSITORY
https://github.com/gsemac/Gsemac.Common

Frequently Asked Questions

What is GHSA-w4x6-hh3x-wjrx?
GHSA-w4x6-hh3x-wjrx is a security vulnerability in Gsemac.Net involving Stale copy of the public suffix list under General Security Weakness.
Which Gsemac.Net versions are affected?
Affected versions include releases prior to 0.38.2 across affected packages: Gsemac.Net.
What version fixes GHSA-w4x6-hh3x-wjrx?
Upgrading to 0.38.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is Gsemac.Net affected?
Yes, Gsemac.Net is affected in releases prior to 0.38.2. Upgrade your dependency to 0.38.2 or later.
What CWE is associated with GHSA-w4x6-hh3x-wjrx?
GHSA-w4x6-hh3x-wjrx is classified under General Security Weakness.
How can I check NuGet dependencies for GHSA-w4x6-hh3x-wjrx?
Run the dependency tree command: 'inspect dependencies for Gsemac.Net'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w4x6-hh3x-wjrx",
  "modified" : "2023-12-11T21:47:14Z",
  "published" : "2023-12-11T21:47:14Z",
  "aliases" : [ ],
  "summary" : "Stale copy of the public suffix list",
  "details" : "We have identified that this project contains an out-of-date version of the Public Suffix List (https://publicsuffix.org/). We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences and journals. Our results will become publicly available after 21 days; this provides time to update your project with an up-to-date version of the Public Suffix List.\n\nGitHub repository: gsemac/Gsemac.Common\nPublic Suffix List path: src/Gsemac.Net/Resources/public_suffix_list.dat\n\nThe Public Suffix List is regularly updated (generally a few times per week), and to ensure that the correct privacy boundaries are maintained between websites, applications that use it should routinely fetch an updated copy. If new suffixes are added to the list, and an old list is then used, privacy boundaries will not be constructed correctly, allowing for data (e.g., cookies) to be set incorrectly, potentially harming privacy.\n\nThere is further guidance on how the Public Suffix List should be used in ICANN’s “Advisory on the Use of Static TLD / Suffix Lists” at https://www.icann.org/en/system/files/files/sac-070-en.pdf.\n\nIf you have any questions about our research, or about usage of the Public Suffix List, please reply via e-mail to [sm@smcquistin.uk](mailto:sm@smcquistin.uk).",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Gsemac.Net"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.38.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gsemac/Gsemac.Common/security/advisories/GHSA-w4x6-hh3x-wjrx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gsemac/Gsemac.Common/commit/e53d203fe1274c8ea6dbb74a6b86f1635cef41bc"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gsemac/Gsemac.Common"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-12-11T21:47:14Z",
    "nvd_published_at" : null
  }
}