Linux Docker: patch status for two critical ASP.NET Core vulnerabilities?

[solidsnakex37 56]

Hi Emby team,

Edit: I’ve submitted the technical findings and supporting evidence privately through Emby’s designated GitHub security reporting channel. I’ve removed the detailed information from this public post while the team reviews it. I opened GHSA-ccv5-j693-6vh3. 

The report concerns potentially vulnerable dependencies bundled with Emby’s Linux distribution. An exploit against my deployment has not been demonstrated.

I’d appreciate confirmation from the team about applicability, any recommended temporary mitigations, and patch availability. I’ll update this thread with official guidance when available.

Thanks to those who pointed me toward the private reporting process.

Edited October 23 by solidsnakex37
Removed the vulnerability information

[Jdiesel 1506]

I believe the best place to report, and track, vulnerabilities is here:

https://github.com/EmbySupport/Emby.Security/security/advisories

[solidsnakex37 56]

23 minutes ago, Jdiesel said:

I believe the best place to report, and track, vulnerabilities is here:

https://github.com/EmbySupport/Emby.Security/security/advisories

Thank you! I submitted it there. I will edit the post and leave the submission private.