Security: No CVE free Azure.Identity 1.3.x available for consumption in e.g. Microsoft.Data.SqlClient 3.1.x

[jsquire]

Issue Transfer

This issue has been transferred from the Azure SDK for .NET repository, #41448.

Please be aware that @simdanne is the author of the original issue and include them for any questions or replies.

Details

Describe the bug

Hi,
The still supported Microsoft.Data.SqlClient has a dependency on Azure.Identity >=1.3.0.

The recently released 3.1.5 version of this thereby still pulls in a version of Azure.Identity that has open CVEs against it (CVE-2023-36414).

I would expect that Azure.Identity team provides a bugfix release of 1.3.x, so the Microsoft.Data.SqlClient can release a 3.1.x that pulls a fixed version in. Upgrading to another minor version that has the fix is impossible for Microsoft.Data.SqlClient since Azure.Identity in already released fixed versions have way different depedencies clashing with MDS.

see #2296 for reference.

[simdanne]

Okay now that we have gone full circle, i hope the PR #2247 will get some traction.
From the outside this looks very unfortunate.
SqlClient should not depend on libraries that are not supported through the officially supported lifetime of SqlClient itself. I understand for this CVE it might not matter much (since SqlClient users are not actually exposed to this, but this could have been different).

[kf-gonzalez]

@simdanne the suggested solution for this is upgrading to MDS 5.1. That is using a newer version of Azure.Identity