jasontaylordev/CleanArchitecture

Azure.Identity 1.10.4 moderate severity vulnerability

Wosiu6 opened this issue · 6 comments

Wosiu6 commented

Describtion
When installing the new version an Azure.Identity 1.10.4 moderate severity vulnerability is preventing you from running it. When trying to update that library to the latest, the application throws an NSwag error.

To Reproduce
Steps to reproduce the behaviour:

  1. dotnet new install Clean.Architecture.Solution.Template::8.0.5
  2. dotnet new ca-sln --client-framework Angular --output test (or React one)
  3. cd test/src/Web -> dotnet run
  4. see error

if you disable warnings as errors you get another error, see attached
log.txt

-- Alternatively --

  1. dotnet new install Clean.Architecture.Solution.Template::8.0.5
  2. dotnet new ca-sln --client-framework Angular --output test (or React one)
  3. update the Azure.Identity 1.10.4 to the latest
  4. try to run again
  5. see error

Expected behaviour
The code to either support the latest version with no vulnerability or clarification on if the warning as error should be bypassed despite the vulnerability

betty2310 commented

Change version of Azure.Identity in Directory.Packages.props file from 1.10.4 to 1.11.0 solve this problem
More information in GitHub Advisory Database

  • 👍3
Wosiu6 commented

Change version of Azure.Identity in Directory.Packages.props file from 1.10.4 to 1.11.0 solve this problem More information in GitHub Advisory Database

That did not work and I still get the same error as seen in the log file I uploaded

furritos commented

The answer @betty2310 provided worked perfectly, thanks!

JasonFoglia commented

In VS 2022 nuget manager, this showed the issue/error/vulnerability, I was able to update the package to the latest 1.11.3 and it works fine for me.

Tip: You can click on "Show only vulnerable" and this package should show.

HSPiira commented

Trick is to update the Azure.Identity package to the latest version

  • 👍1