Azure key vault java sdk code vulnerability with veracode scan

Question

Hi Team,

We are using Azure key vault Java sdk (com.azure:azure-identity ) to integrate with Azure Key vault . After we have ran the veracode scan, we have found few vulnerabilities with Vera code scan.

Do we need to use any specific sdk libraries ?

could you please help us on this ?

Answer 1

Hello @Anonymous , you don't need to use com.azure:azure-identity or any other azure sdk module. You can user alternative libraries or develop your own library/ies following Azure documentation. This however it's not recommended. First we need to assess the vulnerabilities found in the library/package. Please email the verascan vulnerabilities report/results to azcommunity@microsoft.com with Subject Attn: Alfredo Revilla.

In the meantime and as a workaround for the com.azure:azure-identity vulnerabilities you might try any of the following:

1. Upgrade to the latest version of the aforementioned module.
2. Exclude the vulnerable dependency and pin to its latest version in your application pom
3. Use a third-party OAuth Libraries for Javain tandem with the Azure Key Vault client library for Java. You will need to create an app registration, (optional) expose Azure Key Vault scopes/delegated permissions (for user authentication), and add your own TokenCredential implementation.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.