search

arcus-azure / arcus.security

Security for Azure development in a breeze.
https://security.arcus-azure.net/
MIT License
39 stars 12 forks source link

Possible security vulnerability in AzureKeyVault provider #423

Closed fgheysels closed 7 months ago

fgheysels commented 10 months ago

The Azure KeyVault provider project has a (transitive) reference to Newtonsoft.JSON 10.0.3, which apparently has a security vulnerability.

We should upgrade to a more recent version of Newtonsoft.Json. (10.0.3 already dates back to 2017!)

fgheysels commented 10 months ago

Maybe this is because we still use some deprecated packges in that project. Maybe one of those packages is the culprit ?

stijnmoreels commented 10 months ago

Maybe this is because we still use some deprecated packges in that project. Maybe one of those packages is the culprit ?

Yes, that would be my guess as well, as we needed to be backwards compatible. But, with the new major version on .NET 8, we could possibly remove those.

fgheysels commented 9 months ago

I think it is important to have a look at it. There are projects where customers refuse to use dependencies that have possible / known security issues.

stijnmoreels commented 7 months ago

Think this is done by: https://github.com/arcus-azure/arcus.security/pull/424 ?

fgheysels commented 7 months ago

Indeed, this looks to be resolved. Thanks!