PT-2023-32984 · Moq · Moq

Publicado 2023-08-10 · Atualizado 2023-08-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Moq versions 4.20.0-rc through 4.20.1

Description The issue concerns the inclusion of SponsorLink in certain versions of Moq, which runs an obfuscated DLL at build time. This DLL scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this functionality.

Recommendations For Moq versions 4.20.0-rc through 4.20.1, update to Moq version 4.20.2 or later, which has removed the SponsorLink functionality.

Identificadores relacionados

GHSA-6R78-M64M-QWCF

Produtos afetados

Moq

Referências · 6

• https://github.com/moq/moq/issues/1374 · Nota
• https://github.com/moq/moq · Nota
• https://github.com/moq/moq/pull/1363 · Nota
• https://github.com/moq/moq/pull/1375 · Nota
• https://cazzulino.com/sponsorlink.html · Nota
• https://osv.dev/vulnerability/GHSA-6r78-m64m-qwcf · Aviso do Fabricante