Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the Microsoft.Data.SqlClient to Azure.Identity dependency to >=1.10.2 #2217

Closed
danm-de opened this issue Nov 15, 2023 · 1 comment
Closed
Labels
Duplicate This issue or pull request already exists

Comments

@danm-de
Copy link

danm-de commented Nov 15, 2023

The Azure Identity SDK <1.10.2 has a critical (high severity) Remote Code Execution Vulnerability.

Microsoft.Data.SqlClient depends on >= 1.8.0. Since NuGet resolves transitive dependencies to the minimum applicable version, all users are currently at risk unless they manually add Azure.Identity (which very few will do if they use <PackageReference>).

I would highly recomend to update the dependency Azure.Identity to version 1.10.2.

Yes, it's probably a NuGet issue, but it hasn't been solved for years::

@danm-de danm-de changed the title Update dependencies of Microsoft.Data.SqlClient to Azure.Identity to >=1.10.2 Update the Microsoft.Data.SqlClient to Azure.Identity dependency to >=1.10.2 Nov 15, 2023
@JRahnama JRahnama added the Duplicate This issue or pull request already exists label Nov 15, 2023
@JRahnama
Copy link
Member

duplicate of #2181

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Duplicate This issue or pull request already exists
Projects
None yet
Development

No branches or pull requests

2 participants