Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Azure.Identity 1.10.4 moderate severity vulnerability #1171

Open
Wosiu6 opened this issue Apr 23, 2024 · 4 comments
Open

Azure.Identity 1.10.4 moderate severity vulnerability #1171

Wosiu6 opened this issue Apr 23, 2024 · 4 comments

Comments

@Wosiu6
Copy link

Wosiu6 commented Apr 23, 2024

Describtion
When installing the new version an Azure.Identity 1.10.4 moderate severity vulnerability is preventing you from running it. When trying to update that library to the latest, the application throws an NSwag error.

To Reproduce
Steps to reproduce the behaviour:

  1. dotnet new install Clean.Architecture.Solution.Template::8.0.5
  2. dotnet new ca-sln --client-framework Angular --output test (or React one)
  3. cd test/src/Web -> dotnet run
  4. see error

if you disable warnings as errors you get another error, see attached
log.txt

-- Alternatively --

  1. dotnet new install Clean.Architecture.Solution.Template::8.0.5
  2. dotnet new ca-sln --client-framework Angular --output test (or React one)
  3. update the Azure.Identity 1.10.4 to the latest
  4. try to run again
  5. see error

Expected behaviour
The code to either support the latest version with no vulnerability or clarification on if the warning as error should be bypassed despite the vulnerability

@betty2310
Copy link

Change version of Azure.Identity in Directory.Packages.props file from 1.10.4 to 1.11.0 solve this problem
More information in GitHub Advisory Database

@Wosiu6
Copy link
Author

Wosiu6 commented May 3, 2024

Change version of Azure.Identity in Directory.Packages.props file from 1.10.4 to 1.11.0 solve this problem More information in GitHub Advisory Database

That did not work and I still get the same error as seen in the log file I uploaded

@furritos
Copy link

The answer @betty2310 provided worked perfectly, thanks!

@JasonFoglia
Copy link

In VS 2022 nuget manager, this showed the issue/error/vulnerability, I was able to update the package to the latest 1.11.3 and it works fine for me.

Tip: You can click on "Show only vulnerable" and this package should show.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants