Dependency-Track Vulnerability

Dependency-Track is a component analysis platform that identifies and reduces risk in the software supply chain. It scans for dependencies in .NET applications and reports on potential vulnerabilities. However, prior to version 4.13.5, Dependency-Track may inadvertently disclose sensitive information about internal components or send credentials meant for private NuGet repositories to public servers.

You're affected if you use Dependency-Track versions prior to 4.13.5. Check with: dependency-track command-line tool --version

Note: This vulnerability is specific to .NET applications and custom NuGet repositories, so if you don't use these, you're likely not affected.

1. Upgrade to Dependency-Track version 4.13.5 or later from the official GitHub releases page: https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.5
2. Disable custom NuGet repositories until the patch has been applied.
3. Invalidate previously used credentials and generate new credentials for usage after the patch has been applied.

• github.com
• github.com