From 9fbfeb65f9209a6cd028259e6dc791d3b44054f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Henrique=20Inoc=C3=AAncio=20Borba=20Ferreira?=
 <fernfe@microsoft.com>
Date: Fri, 16 Jun 2023 12:02:22 -0700
Subject: [PATCH] [Security] Security Advisory CVE-2023-29331 // dotnet
 v7.0.304 (#3358)

* Fix security alerts.

* Upgrade dotnet to v7.0.304.

* Removing empty spaces. Adding reference to System.Security.Cryptography.Pkcs.

* Chaging dependency in FHIR.Cosmos
---
 Directory.Packages.props                                      | 1 +
 build/docker/Dockerfile                                       | 4 ++--
 build/dotnet6-compat/global.json                              | 2 +-
 global.json                                                   | 2 +-
 .../Microsoft.Health.Fhir.CosmosDb.csproj                     | 1 +
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index af0c67b9e0..ffc149255b 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -110,6 +110,7 @@
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Private.ServiceModel" Version="4.10.2" />
     <PackageVersion Include="System.Security.Cryptography.Xml" Version="7.0.1" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="7.0.2" />
     <PackageVersion Include="System.Text.Encodings.Web" Version="7.0.0" />
     <PackageVersion Include="xunit.extensibility.core" Version="2.4.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.4.5" />
diff --git a/build/docker/Dockerfile b/build/docker/Dockerfile
index 623c8c8468..279a36f0d0 100644
--- a/build/docker/Dockerfile
+++ b/build/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:7.0.203-alpine3.17 AS build
+FROM mcr.microsoft.com/dotnet/sdk:7.0.304-alpine3.17 AS build
 
 ARG FHIR_VERSION
 ARG ASSEMBLY_VER
@@ -68,7 +68,7 @@ COPY . .
 
 RUN dotnet publish /repo/src/Microsoft.Health.Fhir.${FHIR_VERSION}.Web/Microsoft.Health.Fhir.${FHIR_VERSION}.Web.csproj -c Release -o "/build" --no-restore -p:AssemblyVersion="${ASSEMBLY_VER}" -p:FileVersion="${ASSEMBLY_VER}"  -p:Version="${ASSEMBLY_VER}" -f net7.0
 
-FROM mcr.microsoft.com/dotnet/aspnet:7.0.5-alpine3.17 AS runtime
+FROM mcr.microsoft.com/dotnet/aspnet:7.0.7-alpine3.17 AS runtime
 
 ARG FHIR_VERSION
 
diff --git a/build/dotnet6-compat/global.json b/build/dotnet6-compat/global.json
index a28417ba39..3ee63390f0 100644
--- a/build/dotnet6-compat/global.json
+++ b/build/dotnet6-compat/global.json
@@ -1,5 +1,5 @@
 {
     "sdk": {
-        "version": "6.0.408"
+        "version": "6.0.410"
     }
 }
diff --git a/global.json b/global.json
index 2f44de06cc..dfe0d38737 100644
--- a/global.json
+++ b/global.json
@@ -1,5 +1,5 @@
 {
     "sdk": {
-        "version": "7.0.203"
+        "version": "7.0.304"
     }
 }
diff --git a/src/Microsoft.Health.Fhir.CosmosDb/Microsoft.Health.Fhir.CosmosDb.csproj b/src/Microsoft.Health.Fhir.CosmosDb/Microsoft.Health.Fhir.CosmosDb.csproj
index e619f23853..9a2cf11ffa 100644
--- a/src/Microsoft.Health.Fhir.CosmosDb/Microsoft.Health.Fhir.CosmosDb.csproj
+++ b/src/Microsoft.Health.Fhir.CosmosDb/Microsoft.Health.Fhir.CosmosDb.csproj
@@ -23,6 +23,7 @@
     <PackageReference Include="System.Security.Cryptography.Xml">
       <PrivateAssets>All</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\Microsoft.Health.Fhir.Api\Microsoft.Health.Fhir.Api.csproj" />