Azure.Identity vulnerability in a .net project.

Phillip Williams 10 Reputation points
2024-04-12T21:17:12.2533333+00:00

If I create a simple class project using VS2022 whose project definition is this:``

Then I check for vulnerabilities

dotnet list package --vulnerable --include-transitive

I get this output

[net8.0]:

Transitive Package Resolved Severity Advisory URL

> Azure.Identity 1.10.3 Moderate https://github.com/advisories/GHSA-wvxc-855f-jvrv

This issue is causing a problem in the build pipeline which checks for vulnerabilities. It seems that this advisory came out 3 days ago. I downloaded the SDK 8.0.204 and tried running the pipeline using SDK 8.0.204 but the message still occurs.

How to solve this issue?

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,292 questions
.NET
.NET
Microsoft Technologies based on the .NET software framework.
3,391 questions