Azure/azure-iot-sdk-csharp

Microsoft.Azure.Devices.Client v1.42.0 has indirect security vulnerabilies

fgheysels opened this issue · 3 comments

fgheysels commented

I use Microsoft.Azure.Devices.Client Version 1.42.0 in an IoT Edge project, and it appears that this project has a (transitive) dependency on System..Net.Http v4.3 which would contain security vulnarabilities:

image

timtay-microsoft commented

This has been fixed by removing some out-of-support .net targets from this project via #3400

  • 👍1
timtay-microsoft commented

It looks like we also need to replace the Azure Storage SDK that we use in our file upload APIs to fully clear the current security issues here, so I'll un-mark this as "fix checked in" while we work on making that happen

andyk-ms commented

Addressed in 1.42.2 build