[GHSA-6q8c-85p2-954c] In Progress Telerik UI for WPF versions prior to 2024 Q3 ...

[LanceMcCarthy]

This Pull Request replaces #5087

[JonathanLEvans]

Hi @LanceMcCarthy, I am unable to find any of the listed packages in https://www.nuget.org/. Could you provides to them?

[LanceMcCarthy]

@JonathanLEvans That is correct, they are not public nuget.org packages (they are only provided via our NuGet Feed (https://nuget.telerik.com). It is an authenticated feed, when the developer passes credentials with the HTTP request (using packageSourceCredentials) and the server determines what packages they have the license to access/download.

This topic is something I was going to bring up to the .NET team via Microsoft MVP back channels, there should probably be an easier way for you to automatically validate the package, possible through a private proxy that I can arrange with your team. However, this is a longer term thing that likely needs agreement and configuration. For now, I need to manually go through all the items and list them for you.

[LanceMcCarthy]

@JonathanLEvans Here is a real world example where Dependabot will make the identification.

The .NET developer lists our feed, next to nuget.org, in their nuget config file => https://github.com/LanceMcCarthy/.../NuGet.Config

Dependabot doesn't care what the origin was for the package, it only identifies the affected package name and version inside the csproj, for example => https://github.com/LanceMcCarthy/..../MyWpfApp.csproj#L108

Just because the package is not available on nuget.org, it is still available to project via another source. It is still a NuGet dependency. The GitHub user should be able to get the match on the vulnerable package version, then be shown the patched version.

Also, please note that there doesn't even have to be a server feed. NuGet support local package sources, in this case, the source code on GitHub would not be using a server-based source. The developer should still get an alert that the package reference needs to be updated.

[edit] fixed formatting and spelling