Skip to content

Commit 21b0af6

Browse files
swmalswmal
swmal
and
swmal
authored
Security updates 8.6.3 - System.Security.Cryptography.Xml (#2438)
* Added DisableImageFunctionDownloads property to ParsingConfiguration. If true the IMAGE function will not download external content * Update System.Security.Cryptography.Xml to 8.0.4/9.0.18/10.0.10 for CVE-2026-47302/47304/50525/50527/50648. Bump version to 8.6.3. * Additional fixes för appveyor8.yml, fixedIssures.md and EPPlus project file --------- Co-authored-by: swmal <{ID}+username}@users.noreply.github.com>
1 parent d8416ee commit 21b0af6

4 files changed

Lines changed: 27 additions & 20 deletions

File tree

‎appveyor8.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
version: 8.6.2.{build}
1+
version: 8.6.3.{build}
22
branches:
33
only:
44
- develop8
@@ -10,15 +10,15 @@ install:
1010
& $env:temp\dotnet-install.ps1 -Architecture x64 -Version '10.0.100' -InstallDir "$env:ProgramFiles\dotnet"
1111
init:
1212
- ps: >-
13-
Update-AppveyorBuild -Version "8.6.2.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
13+
Update-AppveyorBuild -Version "8.6.3.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
1414
15-
Write-Host "8.6.2.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
15+
Write-Host "8.6.3.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
1616
dotnet_csproj:
1717
patch: true
1818
file: '**\*.csproj'
1919
version: '{version}'
20-
assembly_version: 8.6.2.{build}
21-
file_version: 8.6.2.{build}
20+
assembly_version: 8.6.3.{build}
21+
file_version: 8.6.3.{build}
2222
nuget:
2323
project_feed: true
2424
before_build:

‎docs/articles/fixedissues.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
# Features / Fixed issues - EPPlus 8
2+
## Version 8.6.3
3+
### Security
4+
* Updated System.Security.Cryptography.Xml to address five security vulnerabilities in the .NET XML signing dependency: four denial of service vulnerabilities (CVE-2026-47302, CVE-2026-50525, CVE-2026-50527, CVE-2026-50648) and one security feature bypass (CVE-2026-47304). The package is updated to 8.0.4 (.NET Framework, .NET 8 and .NET Standard), 9.0.18 (.NET 9) and 10.0.10 (.NET 10).
25
## Version 8.6 2
36
### Minor features and fixed issues
47
* Added property ´AlwaysRefreshImageFunction´ to ´ParsingConfiguration´, to disable download of external content in the calculation of the IMAGE function.

‎src/Directory.Packages.props‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
1010
<PackageVersion Include="System.Drawing.Common" Version="8.0.26" />
1111
<PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
12-
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
13-
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
12+
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
13+
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.4" />
1414
<PackageVersion Include="System.Text.Encoding.CodePages" Version="8.0.0" />
1515
<PackageVersion Include="System.Text.Json" Version="8.0.6" />
1616
</ItemGroup>

‎src/EPPlus/EPPlus.csproj‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
33
<TargetFrameworks>net8.0;net9.0;net10.0;netstandard2.1;netstandard2.0;net462;net35</TargetFrameworks>
4-
<AssemblyVersion>8.6.2.0</AssemblyVersion>
5-
<FileVersion>8.6.2.0</FileVersion>
6-
<Version>8.6.2</Version>
4+
<AssemblyVersion>8.6.3.0</AssemblyVersion>
5+
<FileVersion>8.6.3.0</FileVersion>
6+
<Version>8.6.3</Version>
77
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
88
<PackageProjectUrl>https://epplussoftware.com</PackageProjectUrl>
99
<Authors>EPPlus Software AB</Authors>
@@ -18,14 +18,17 @@
1818
<PackageReadmeFile>readme.md</PackageReadmeFile>
1919
<Copyright>EPPlus Software AB</Copyright>
2020
<PackageReleaseNotes>
21-
EPPlus 8.6.2
21+
EPPlus 8.6.3
2222

2323
IMPORTANT NOTICE!
2424
From version 5 EPPlus changes the license model using a dual license, Polyform Non Commercial / Commercial license.
2525
EPPlus will still have the source available, but for non Polyform NC compliant projects, EPPlus will provide a commercial license.
2626
Commercial licenses can be purchased from https://epplussoftware.com
2727
This applies to EPPlus version 5 and later. Earlier versions are still licensed LGPL.
2828

29+
## Version 8.6.3
30+
* Updated System.Security.Cryptography.Xml to address security vulnerabilities (CVE-2026-47302, CVE-2026-47304, CVE-2026-50525, CVE-2026-50527, CVE-2026-50648).
31+
2932
## Version 8.6.2
3033
* Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
3134

@@ -583,8 +586,9 @@
583586
A list of fixed issues can be found here https://epplussoftware.com/docs/8.6/articles/fixedissues.html
584587

585588
Version history
589+
8.6.3 20260724 Updated System.Security.Cryptography.Xml for security vulnerabilities.
586590
8.6.2 20260721 Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
587-
8.6.1 20260616 3 new functions. Minor bug fixes.
591+
8.6.1 20260616 3 new functions. Minor bug fixes.
588592
8.6.0 20260529 9 new functions. Support for trim Reference operator.
589593
8.5.4 20260430 Minor bug fixes.
590594
8.5.3 20260416 Updated .NET 8 references incorrectly update to 9.x to 8.x.
@@ -790,20 +794,20 @@
790794
</ItemGroup>
791795

792796
<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
793-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.15" />
797+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.18" />
794798
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
795-
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.15" />
799+
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.18" />
796800
<PackageReference Include="System.ComponentModel.Annotations" />
797-
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.15" />
798-
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.15" />
801+
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.18" />
802+
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.18" />
799803
</ItemGroup>
800804
<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
801-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.7" />
805+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.10" />
802806
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
803-
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.7" />
807+
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.10" />
804808
<PackageReference Include="System.ComponentModel.Annotations" />
805-
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.7" />
806-
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.7" />
809+
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.10" />
810+
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.10" />
807811
</ItemGroup>
808812
<ItemGroup>
809813
<Compile Remove="LoadFunctions\HeaderReader.cs" />

0 commit comments

Comments
 (0)