Updated netcore System.Security.Cryptography.Xml to 6.0.1

[Havunen]

Fixes https://github.com/dotnet/wcf/issues/4877

[andreicristianpetcu]

Is there any update on this? @mconnew @Havunen

[mconnew]

@andreicristianpetcu, take a look at the referenced issue for more details. Basically, you don't need to worry about this as the vulnerable scenario isn't one that the WCF Core Client uses (validating an externally provided XML signature). We only use it to sign an internally created XML fragment so there's no untrusted XML being processed which could trigger the vulnerability. If you need to do something to quieten some automated tooling which is flagging this, you can add a direct dependency to your own project to the later version as top level project dependent versions override what packages ask for.

[andreicristianpetcu]

I'm not sure I feel comfortable with swapping libraries like that. It might cause unexpected behavior. I think that if this is such an easy fix, it should be upgrade here, right? @mconnew

[Havunen]

Yeah updating this package in the application level is problematic as we have multiple solutions and hundreds of projects and this issue is coming from many places through dependencies