You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Microsoft.Data.SqlClient depends on >= 1.8.0. Since NuGet resolves transitive dependencies to the minimum applicable version, all users are currently at risk unless they manually add Azure.Identity (which very few will do if they use <PackageReference>).
I would highly recomend to update the dependency Azure.Identity to version 1.10.2.
Yes, it's probably a NuGet issue, but it hasn't been solved for years::
The text was updated successfully, but these errors were encountered:
danm-de
changed the title
Update dependencies of Microsoft.Data.SqlClient to Azure.Identity to >=1.10.2
Update the Microsoft.Data.SqlClient to Azure.Identity dependency to >=1.10.2
Nov 15, 2023
The Azure Identity SDK <1.10.2 has a critical (high severity) Remote Code Execution Vulnerability.
Microsoft.Data.SqlClient depends on >= 1.8.0. Since NuGet resolves transitive dependencies to the minimum applicable version, all users are currently at risk unless they manually add Azure.Identity (which very few will do if they use <PackageReference>).
I would highly recomend to update the dependency Azure.Identity to version 1.10.2.
Yes, it's probably a NuGet issue, but it hasn't been solved for years::
The text was updated successfully, but these errors were encountered: