Security Findings in Aspose.Slides for Python via .NET 26.8 Bundled Runtime

Aspose.Slides Product Family
,
1

Thank you for resolving the earlier findings tracked under SLIDESPYNET-292 in Aspose.Slides for Python via .NET 26.8.

During validation of version 26.8.0 on Linux x86-64, our security scan identified a new and separate set of findings in components bundled under site-packages/asposeslides/_native/:

  • System.Security.Cryptography.Xml 8.0.2: 8 High findings. The scanner identifies 8.0.4 as the minimum remediated version.
  • Microsoft.NETCore.App.Runtime.linux-x64 10.0.0: 1 High and 3 Medium findings. The scanner identifies 10.0.11 as the minimum remediated version.

These components are included in the proprietary Aspose wheel. The Aspose loader selects its private .NET runtime, so installing an updated system runtime does not replace the affected files.

Could you please:

  1. Create a new internal issue for these Aspose 26.8 findings.
  2. Rebuild the Linux wheel with:
    • .NET Runtime >= 10.0.11
    • System.Security.Cryptography.Xml >= 8.0.4
  3. Confirm the planned Aspose release and expected remediation date.
  4. Confirm whether an updated 26.8 wheel could be provided before the next regular release.

This request is separate from SLIDESPYNET-292, which appears to be successfully resolved. The previous discussion is: CVE-2024-0057 Still Present in Aspose.Slides for Python via .NET 26.7.0 - #3 by andrey.potapov

We can provide the detailed scan report and CVE list if required.

2

@ChrisBurns,
Thank you for describing the issue.

We have opened the following new ticket(s) in our internal issue tracking system and will deliver their fixes according to the terms mentioned in Free Support Policies.

Issue ID(s): SLIDESPYNET-365

You can obtain Paid Support Services if you need support on a priority basis, along with the direct access to our Paid Support management team.

3

@ChrisBurns,
The issues you found earlier (filed as SLIDESPYNET-365) have been resolved in Aspose.Slides for Python 26.8.1 (Windows x64, Windows x86, Linux x86-64, Linux ARM64, macOS x86-x64, macOS ARM64).
You can check all fixes on the Release Notes page.
You can also find the latest version of our library on the Product Download page or PyPI.