BDSA-2018-5195 vulnerability by BD hub for newtonsoft version JamesNK/Newtonsoft.Json11.0.2

[rsrinivasanhome]

Hi,

Can the version of the Newtonsoft.Json be bumped up to 13.0.1. ? BD hub is raising a vulnerability - BDSA-2018-5195

For more info refer link
JamesNK/Newtonsoft.Json#2535

[dougbu]

Working on this in #352 but the change is going poorly for this legacy repository

[dougbu]

This will be fixed in the next ASP.NET / MVC release. We're hoping to do that before the end of February but have more work to do. The code is no longer impacted by the vulnerability referenced here.

Relevant PRs included:

• Bump Newtonsoft.Json to 13.0.1 #369
• Use Newtonsoft.Json.Bson except in NetCore projects #370
• Move NetCore project to use .NET SDK #380

Other PRs in the gaps above helped get us from old versions of Newtonsoft.Json and NewtonSoft.Json.Bson. But those were the main ones that actually changed the versions and reacted (mostly in tests) to changes in the new packages.

If it matters, the next release will likely be versioned 3.3.0 and 5.3.0. The Microsoft.AspNet.WebApi.Client package will probably jump to 6.0.0 due to significant changes there.