Vulnerability found in SonarAnalyzer.CSharp

[Colin]

Hey there.

This vulnerability has been raised by our own internal source composition analysis and vulnerability scanners. After risk assessment of exploitability, we have made the decision to not fix the finding immediately for the following reasons:

1. a limitation in the .NET compiler means that it cannot be upgraded without an unacceptable performance impact. We have reported the issue.
2. the protobuf file is both generated and consumed by our software.
3. the impact of failure in our use-case is low risk

That said, we are investigating various work-arounds for the problem or replacements for Google.Protobuf but we have no ETA at this time.

In the future, please check out this guide on Responsible Vulnerability Disclsoure:

Responsible Vulnerability Disclosure

Follow this guide if you’ve found a vulnerability in one of Sonar’s products or websites and you want to responsibly report it. Sonar customers with a support contract can report the vulnerability directly through the support channel. Otherwise, send an email to security@sonarsource.com. What we need from you: Detail the steps you followed that make the vulnerability exploitable including any URLs or code you used. The more information you provide, the faster we can reproduce and fix the pr…