[BUG] Vulnerable transitive package included with Azure.Extensions.AspNetCore.DataProtection.Blobs 1.3.3 about azure-sdk-for-net HOT 5 CLOSED

Just to further compound my confusion, I just added Microsoft.AspNetCore.DataProtection.Extensions:8.0.2 and the System.Common.Drawing transative package vanished. Removing said package brings it back.

from azure-sdk-for-net.

Hi @clbarrett. Thanks for reaching out and we regret that you're experiencing difficulties. This traces back to System.Security.Permissions v4.7.0, which has a dependency on System.Windows.Extensions only for its netcoreapp3.0 target. Neither its netstandard2.0 or net461 targets hold that dependency. This has been discussed this with the Azure SDK and .NET security teams and they confirmed that this is considered a false positive by the scanner rather than an active security risk, as the issue being flagged exists only for an unsupported platform. If you have a need to mitigate the false positive, the recommendation is to take a direct dependency on a version of Microsoft.AspNetCore.DataProtection in your application that is not flagged by the scanner.

Unfortunately, we're out of minor versions of Microsoft.AspNetCore.DataProtection to move to and moving to a new major version requires additional validation and testing. We're tracking this work in #35707, but I don't currently have an estimate on when we'll have bandwidth to schedule work on it.

from azure-sdk-for-net.

Hi @clbarrett. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

from azure-sdk-for-net.

I... just realized that I was using the wrong package for my .Net 6.0 project. Thanks for letting me know about the situation.

from azure-sdk-for-net.

Hi @clbarrett, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.

from azure-sdk-for-net.