CVE-2018-8292 on Akka.Streams and Akka.Remote

[Arkatufus]

CVE report: https://nvd.nist.gov/vuln/detail/cve-2018-8292

Currently, Akka.Streams and Akka.Remote are affected by this CVE due to transitive dependencies to System.Net.Http and Reactive.Streams. Note that anything that references .NET Standard 1.6 will be affected by this CVE.

Things that need to be done to correct this:

• Fork the defunct Reactive.Streams repo into akkadotnet repo
• Modernize the forked Reactive.Streams repo
• Update Akka.Remote Dotnetty reference to 0.7.6

[Aaronontheweb]

FWIW, this is a dumb CVE that doesn't even have any real exposure in Akka.NET - it all stems from calls in System.Net.Http, which we don't use anywhere in the framework.

[Aaronontheweb]

What blows my mind is that CodeQL hasn't even detected on this on any of the hundreds of PRs its scanned since this CVE was filed - guess it's because we're not adding it in a new PR?

[Arkatufus]

Probably because CodeQL only scans the dependency graph 1 layer deep, it doesn't do a full dependency graph scan.

[Arkatufus]

We just need to bump Reactive.Streams to 1.0.3 and we should be golden

[Aaronontheweb]

Resolved via #7213