Event server plugin Dll-conflict (System.Text.Json.dll)

MIP
, ,
1

Hi, I stumbled on a Dll-conflict with an event server plugin integration on 2024 R1. The problem is that I cannot load System.Text.Json.dll version from the plugin code (System.IO.FileLoadException - Could not load file of assembly…).

  • In the plugin I reference version 8.0.1024 of System.Text.Json.dll (NuGet 8.0.5)
  • The event server (2024 R1+hotfixes) ships with version 4.700.20.21406
  • The event server does assembly binding (VideoOS.Event.Server.exe.config): 0.0.0.0-4.2.0.1 → 4.2.0.1
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
  <dependentAssembly>
    <assemblyIdentity name="System.Text.Json" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
    <bindingRedirect oldVersion="0.0.0.0-4.0.1.2" newVersion="4.0.1.2" />
  </dependentAssembly>
</assemblyBinding>

This problem does not happen on for example 2023 R2 since the event server doesn’t ship with System.Text.Json.

I rather not downgrade System.Text.Json in my plugin:

  • Complicated since this library is just a dependency of other libraries
  • There are CVEs reported on versions prior to 8.0.5.

What is the recommended solution for this problem?

2

Hi Mikael,

If I recall well, we were unable to update the package for the same reason - dependencies from other packages. Namely we using ASP.NET Core 2.1 for .NET Framework (which is the latest that is still supported).

Having that in mind, you could suggest, we are not going to migrate

The CVEs are usually reported on particular functionality, that is vulnerable. So if don’t use it in your code, you are safe to use the respective version of the assembly.

This would be my proposal as well.

All other options could be more problematic.

3

@Petar Vutov​ - that make sense. We will consider how to proceed.

BTW - my temporary workaround is to change the assembly mapping in the VideoOS.Event.Server.exe.config file to 0.0.0.0-8.0.0.4 → 8.0.0.4

This makes our plugin able to load System.Text.Json.dll. But maybe this will effect something in the core event server?

4

@Mikael Ståle​ As this is not something we’ve tested, I cannot confirm it would work without any additional issues. It is on your / customer responsibility.