Fix CVE vulnerabilities in transitive NuGet dependencies (#1204)

[pm7y]

Are you a customer of Octopus Deploy? Please contact our support team so we can triage your PR, so that we can make sure it's handled appropriately.

Background

#1204

The octopusdeploy/tentacle container image bundles transitive NuGet dependencies with known CVEs in /opt/octopus/tentacle/Tentacle.deps.json. These are flagged by container vulnerability scanners (Azure Defender for Cloud, Trivy, Snyk, etc.) and cannot be remediated by image consumers.

This PR pins 6 vulnerable transitive dependencies to their fixed versions by adding explicit PackageReference entries to Octopus.Tentacle.csproj.

Results

CVE	Severity	Package	Before	After
CVE-2024-38095	High	System.Formats.Asn1	6.0.0	6.0.1
CVE-2023-29331	High	System.Security.Cryptography.Pkcs	6.0.1	6.0.3
CVE-2017-11770	High	System.Security.Cryptography.X509Certificates	4.1.0	4.3.2
CVE-2018-8292	Medium	System.Net.Http	4.1.0	4.3.4
CVE-2019-0657, CVE-2019-0980, CVE-2019-0981	Medium	System.Private.Uri	4.3.0	4.3.2
CVE-2019-0820	Medium	System.Text.RegularExpressions	4.3.0	4.3.1

Before

Container vulnerability scanners flag 8 CVEs (3 High, 5 Medium) from /opt/octopus/tentacle/Tentacle.deps.json.

After

All 8 CVEs resolved. No functional changes — only transitive dependency version pins.

How to review this PR

This is a low-risk dependency pin change. The packages are already present as transitive dependencies; we are only overriding their versions to pick up security fixes.

Key points to verify:

• System.Formats.Asn1 and System.Security.Cryptography.Pkcs are conditioned on '$(TargetFrameworkIdentifier)' != '.NETFramework' because they only target netstandard2.1/net6.0+ and would break the net48 build
• The remaining 4 packages support all target frameworks and are unconditional
• System.Security.Cryptography.X509Certificates is pinned to 4.3.2 (not the NVD-listed 4.1.2) because System.Net.Http 4.3.4 depends on >= 4.3.0

Quality ✔️
Build all target frameworks (net48, net8.0, net8.0-windows) and run the existing test suite.

Pre-requisites

• I have read How we use GitHub Issues for help deciding when and where it's appropriate to make an issue.
• I have considered informing or consulting the right people, according to the ownership map

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}