Remediating .NET Core App 3.1 open source dependencies vulnerabilities

Recently, I ran a Whitesource Bolt scan on Azure DevOps targeting a .NET Core 3.1 API project.

The result is the following

For sake of accessibility, I'll report what looks relevant to this question

• CVE-2021-26701 affects system.text.encodings.web.4.5.0.nupkg and according to Microsoft it is advisable to Upgrade to version System.Text.Encodings.Web - 4.5.1,4.7.2,5.0.1
• CVE-2018-8292 affects system.net.http.4.3.0.nupkg and can be fixed by Upgrade to version System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

I spoke to our developer and they made a detailed analysis. These dependencies are not direct dependencies. The .NET Framework 3.1 depends on those.

They also said that the production machine is already patched with the latest version of .NET Core (no accessible version of the screenshot)

The .csproj file indeed references netcoreapp31 as target platform, and there is basically no additional way to force a specific version of the framework.

For sake of completeness, here is the full .csproj file

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>netcoreapp3.1</TargetFramework>
  </PropertyGroup>

  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
    <DocumentationFile>xxx.API.xml</DocumentationFile>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="8.1.0" />
    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.15.0" />
    <PackageReference Include="Microsoft.ApplicationInsights.NLogTarget" Version="2.15.0" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="3.1.9">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="3.1.9" />
    <PackageReference Include="Newtonsoft.Json" Version="12.0.3" />
    <PackageReference Include="NLog" Version="4.7.5" />
    <PackageReference Include="NLog.Web.AspNetCore" Version="4.9.3" />
    <PackageReference Include="xxx.yyy" Version="0.2.7" />
    <PackageReference Include="xxx" Version="0.8.6" />
    <PackageReference Include="Swashbuckle.AspNetCore" Version="5.6.3" />
    <PackageReference Include="Swashbuckle.AspNetCore.Swagger" Version="5.6.3" />
  </ItemGroup>

  <ItemGroup>
    <ProjectReference Include="..\xxx.Mappers\xxx.Mappers.csproj" />
    <ProjectReference Include="..\xxx.Services\xxx.Services.csproj" />
  </ItemGroup>

  <ItemGroup>
    <Folder Include="Properties\PublishProfiles\" />
  </ItemGroup>

  <ItemGroup>
    <None Update="xxx.API.xml">
      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
    </None>
  </ItemGroup>


</Project>

There are a couple of private dependencies, but I checked them and there is no direct dependencies to the affected packages.

Also, bulding the application shows that the affected dependencies do not appear in the final zip file, so they are definitely provided dependencies.

Question time

Is it really a false positive from Bolt? Can I confirm

Is it possible to commit anything to repository so that the alerts get fixed? E.g. disappear from the report?