mitigate CVE-2021-24112 (#2707)

* mitigate CVE-2021-24112 * changelog * upgrade System.Diagnostics.PerformanceCounter instead * testing fix to resolve conflict with Test project
microsoft · Nov 7, 2022 · 7191788 · 7191788
1 parent 35b1a30
commit 7191788
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Changelog
 
 ## VNext
+- [Upgrade System.Diagnostics.PerformanceCounter to version 6.0.0 to address CVE-2021-24112](https://github.com/microsoft/ApplicationInsights-dotnet/pull/2707)
 
 ## Version 2.22.0-beta1
 - Update endpoint redirect header name for QuickPulse module to v2

diff --git a/NETCORE/test/IntegrationTests.Tests/IntegrationTests.Tests.csproj b/NETCORE/test/IntegrationTests.Tests/IntegrationTests.Tests.csproj
@@ -23,8 +23,6 @@
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.9.4" />
 
     <ProjectReference Include="..\IntegrationTests.WebApp\IntegrationTests.WebApp.csproj" />
-
-    <PackageReference Include="System.Security.Permissions" Version="4.7.0" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/WEB/Src/PerformanceCollector/PerformanceCollector/Perf.csproj b/WEB/Src/PerformanceCollector/PerformanceCollector/Perf.csproj
@@ -29,7 +29,7 @@
 
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="1.0.0" />
-    <PackageReference Include="System.Diagnostics.PerformanceCounter" Version="4.7.0" />
+    <PackageReference Include="System.Diagnostics.PerformanceCounter" Version="6.0.0" />
   </ItemGroup>
 
   <ItemGroup>