Microsoft.Data.SqlClient 5.1.1 uses Azure.Identity which has a known HIGH vulnerability CVE-2023-36414

[ThomasHeijtink]

Issue

Microsoft.Data.SqlClient 5.1.1 uses Azure.Identity 1.7.0 which has a known HIGH vulnerability CVE-2023-36414.

On top of that I'm surprised that it references Azure.Identity at all. Since this seems to me a higher order concern than sec the SqlClient.

To reproduce

Get a clean project and add a dependency to Microsoft.Data.SqlClient 5.1.1

Run de following command in powershell

dotnet list package --vulnerable --include-transitive --format json

Further technical details

Microsoft.Data.SqlClient version: 5.1.1
.NET target: .NET 7
SQL Server version: NA
Operating system: Windows 11

[roji]

Duplicate of #2181 and #1108.

[ThomasHeijtink]

I apologize. Looking at the vulnerability, it looked like it was a very recent vulnerability. I should've looked further. Both issues have indeed been addressed. Thanks for notifying. This can be closed.