Updates for v2.7.3

axunonb · Jun 28, 2022 · 3a41211 · 3a41211
1 parent e4f8291
commit 3a41211
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -274,6 +274,12 @@ This package is a SmartFormat extension for formatting `System.DateTime`, `Syste
 
 ---
 
+v2.7.3
+===
+* **Hot fix**: Newtonsoft.Json prior to version 13.0.1 is vulnerable. The minimum version of the package reference is now 13.0.1
+Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS).
+
+
 v2.7.2
 ===
 * **Fixed**: `ConditionalFormatter` processes unsigned numbers in arguments correctly.