GHSA-g4vj-cjjj-v7hg Defense in Depth update for NuGet Client

• NuGet NuGet.Packaging: >= 4.9.0, < 4.9.7 → fixed in 4.9.7 • NuGet NuGet.Packaging: >= 5.11.0, < 5.11.7 → fixed in 5.11.7 • NuGet NuGet.Packaging: >= 6.8.0, < 6.8.2 → fixed in 6.8.2 • NuGet NuGet.Packaging: >= 6.11.0, < 6.11.2 → fixed in 6.11.2 • NuGet NuGet.Packaging: >= 6.12.0, < 6.12.5 → fixed in 6.12.5 • NuGet NuGet.Packaging: >= 6.14.0, < 6.14.3 → fixed in 6.14.3 • NuGet NuGet.Packaging: >= 7.0.0, < 7.0.3 → fixed in 7.0.3 • NuGet NuGet.Packaging: >= 7.3.0, < 7.3.1 → fixed in 7.3.1 • NuGet NuGet.Protocol: >= 4.9.0, < 4.9.7 → fixed in 4.9.7 • NuGet NuGet.Protocol: >= 5.11.0, < 5.11.7 → fixed in 5.11.7 • NuGet NuGet.Protocol: >= 6.8.0, < 6.8.2 → fixed in 6.8.2 • NuGet NuGet.Protocol: >= 6.11.0, < 6.11.2 → fixed in 6.11.2 • NuGet NuGet.Protocol: >= 6.12.0, < 6.12.5 → fixed in 6.12.5 • NuGet NuGet.Protocol: >= 6.14.0, < 6.14.3 → fixed in 6.14.3 • NuGet NuGet.Protocol: >= 7.0.0, < 7.0.3 → fixed in 7.0.3 • NuGet NuGet.Protocol: >= 7.3.0, < 7.3.1 → fixed in 7.3.1 • NuGet NuGet.CommandLine: >= 4.9.0, < 4.9.7 → fixed in 4.9.7 • NuGet NuGet.CommandLine: >= 5.11.0, < 5.11.7 → fixed in 5.11.7 • NuGet NuGet.CommandLine: >= 6.8.0, < 6.8.2 → fixed in 6.8.2 • NuGet NuGet.CommandLine: >= 6.11.0, < 6.11.2 → fixed in 6.11.2 • NuGet NuGet.CommandLine: >= 6.12.0, < 6.12.5 → fixed in 6.12.5 • NuGet NuGet.CommandLine: >= 6.14.0, < 6.14.3 → fixed in 6.14.3 • NuGet NuGet.CommandLine: >= 7.0.0, < 7.0.3 → fixed in 7.0.3 • NuGet NuGet.CommandLine: >= 7.3.0, < 7.3.1 → fixed in 7.3.1

Impact This update adds validation of the package ID and version during package download, in addition to the existing package signature validation. Patches NuGet The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched: |Affected versions|Patched version| |--|--| |>= 4.9.0, = 5.11.0, = 6.8.0, = 6.11.0, = 6.12.0, = 6.14.0, = 7.0.0, <= 7.0.2|7.0.3| |7.3.0|7.3.1| .NET SDK • .NET 8.0.126 SDK • .NET 8.0.420 SDK • .NET 9.0.116 SDK • .NET 9.0.313 SDK • .NET 10.0.106 SDK • .NET 10.0.202 SDK Workarounds N/A References https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr Credit splitline with DEVCORE