Add reference to System.Security.Cryptography.Xml (#198)

pjcollins · web-flow · commit 9f02d77692bc · 2022-11-30T11:20:39.000-05:00
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/8008980?typeId=5585428&pipelinesTrackingFilter=1 We've receieved an alert about our usage of the 6.0.0 version of `System.Security.Cryptography.Xml`. This package is brought in through the [Microsoft.Build.Tasks.Core][0] package reference. An explicit reference to `System.Security.Cryptography.Xml` 6.0.1 should bring in the fix for CVE-2022-34716. [0]: https://www.nuget.org/packages/Microsoft.Build.Tasks.Core/17.3.2#dependencies-body-tab
diff --git a/src/Microsoft.Android.Build.BaseTasks/MSBuildReferences.projitems b/src/Microsoft.Android.Build.BaseTasks/MSBuildReferences.projitems
@@ -14,6 +14,7 @@
     <PackageReference Include="Microsoft.Build.Framework"      Version="$(MSBuildPackageReferenceVersion)" />
     <PackageReference Include="Microsoft.Build.Tasks.Core"     Version="$(MSBuildPackageReferenceVersion)" />
     <PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MSBuildPackageReferenceVersion)" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="6.0.1" />
     <PackageReference Include="K4os.Compression.LZ4" Version="1.1.11" />
     <PackageReference Include="Xamarin.Build.AsyncTask" Version="0.4.0" GeneratePathProperty="true" />
     <PackageReference Include="Xamarin.LibZipSharp" Version="$(LibZipSharpVersion)" GeneratePathProperty="true" />
