Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Microsoft.Azure.Devices.Client v1.42.0 has indirect security vulnerabilies #3397

Closed
fgheysels opened this issue Nov 24, 2023 · 3 comments
Closed

Microsoft.Azure.Devices.Client v1.42.0 has indirect security vulnerabilies #3397

fgheysels opened this issue Nov 24, 2023 · 3 comments
Assignees
@timtay-microsoft
Labels
bug Something isn't working. IoTSDK Tracks all IoT SDK issues across the board

Comments

@fgheysels
Copy link

I use Microsoft.Azure.Devices.Client Version 1.42.0 in an IoT Edge project, and it appears that this project has a (transitive) dependency on System..Net.Http v4.3 which would contain security vulnarabilities:

image
@fgheysels fgheysels added the bug Something isn't working. label Nov 24, 2023
@github-actions github-actions bot added the IoTSDK Tracks all IoT SDK issues across the board label Nov 24, 2023
@timtay-microsoft
Copy link
Member

This has been fixed by removing some out-of-support .net targets from this project via #3400

@timtay-microsoft timtay-microsoft self-assigned this Dec 1, 2023
@timtay-microsoft timtay-microsoft added the fix-checked-in Fix checked into main or preview, but not yet released. label Dec 1, 2023
@timtay-microsoft
Copy link
Member

It looks like we also need to replace the Azure Storage SDK that we use in our file upload APIs to fully clear the current security issues here, so I'll un-mark this as "fix checked in" while we work on making that happen

@timtay-microsoft timtay-microsoft removed the fix-checked-in Fix checked into main or preview, but not yet released. label Dec 13, 2023
@andyk-ms
Copy link
Contributor

Addressed in 1.42.2 build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@timtay-microsoft timtay-microsoft

Labels
bug Something isn't working. IoTSDK Tracks all IoT SDK issues across the board
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@fgheysels @timtay-microsoft @andyk-ms