Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update JsonWebTokens and OpenIdConnect vulnerable package references #2299

Closed
micah686 opened this issue Jan 16, 2024 · 2 comments
Closed

Update JsonWebTokens and OpenIdConnect vulnerable package references #2299

micah686 opened this issue Jan 16, 2024 · 2 comments

Comments

@micah686
Copy link

SqlClient 5.14 currently relies on transient packages that have vulnerabilities.
Microsoft.IdentityModel.JsonWebTokens is being referenced at version 6.24.0, which currently is vulnerable.
Microsoft.IdentityModel.Protocols.OpenIdConnect is being referenced at version 6.24.0, which has a dependency of System.IdentityModel.Tokens.Jwt , which is vulnerable.

Could these packages please be updated to non-vulnerable versions?

@AdaskoTheBeAsT
Copy link

in corporate software for checking vulnerabilities in dependencies Mend (previously Whitesource) - in every lib in which I use Microsoft.Data.SqlClient I need to also manually install Azure.Core and now also System.IdentityModel.Tokens.Jwt

will it be possible to introduce in M$ such process that whenever some vulnerability will be found in some package all M$ packages dependant on vulnerable package will be released with new dependency? any ideas how to be safe by design instead of pushing that on shoulders of developers? can M$ libraries use semantic versioning like in nodejs? similar to ^ or ~ prefix? instead of hardcoded strict numbers in dependencies?

@JRahnama JRahnama added this to Needs triage in SqlClient Triage Board via automation Jan 16, 2024
@kf-gonzalez
Copy link

This issue will be addressed in preview5. Addressed by #2290

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Development

No branches or pull requests

4 participants