Update msbuild reference package to get clean on scanners

[marcpopMSFT]

Install 7.0.420, 8.0.103, and 8.0.203 SDKs
findstr /I /S System.Security.Cryptography.xml *deps.json from the SDK folder

7.0.408-dev\Roslyn\Microsoft.Build.Tasks.CodeAnalysis.deps.json: "System.Security.Cryptography.Xml/4.7.0": {
8.0.103\Roslyn\Microsoft.Build.Tasks.CodeAnalysis.deps.json: "System.Security.Cryptography.Xml/4.7.0": {
8.0.203\Roslyn\Microsoft.Build.Tasks.CodeAnalysis.deps.json: "System.Security.Cryptography.Xml/6.0.0": {

The above versions had a known vulnerability. Even though the package isn't installed, we're trying to get clean on the scanners by updating where we can. Our focus is on 6.0.4xx, 7.0.4xx, and all 8 versions.

Looking at the deps.json, the value appears to come from these locations.
https://github.com/dotnet/roslyn/blob/release/dev17.7/eng/Versions.props#L37
https://github.com/dotnet/roslyn/blob/release/dev17.8/eng/Versions.props#L34
https://github.com/dotnet/roslyn/blob/release/dev17.9/eng/Versions.props#L34

MSBuild has an updated version of 17.3 (17.3.4) that you should be able to use in 17.9. For 17.7 and 17.8, can you update to 17.0 or 17.3 potentially?

[marcpopMSFT]

@jaredpar per our recent meeting, I filed this issue. I went and double checked and unfortunately, 7.0.4xx and 8.0.1xx are being flagged as well and your reference version of msbuild there is 16.10 which is harder to upgrade (as they don't have an available 16.10 with the fixes).

[marcpopMSFT]

We did a scan of 8.0.3xx previews and found this one as well which is being flagged: https://github.com/dotnet/roslyn/blob/release/dev17.10/src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj#L27

[ericstj]

I'm not seeing this repro when building the release/dev17.10 branch. In that case I see:

      "Microsoft.Build.Tasks.Core/17.7.2": {
        "dependencies": {
...
          "System.Security.Cryptography.Xml": "7.0.1",

Seems that was fixed by @tmat in db94f71

[ericstj]

@marcpopMSFT aren't 17.7 and 17.9 going away? If that's the case then the only one remaining is 17.8. Does that sound right?

[genlu]

Closed since this is fixed by #73113