Update HIGH vulnerable dependencies [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Azure.Identity (source)	1.9.0 -> 1.11.4
lodash (source)	4.17.20 -> 4.17.21

GitHub Vulnerability Alerts

CVE-2023-36414

Azure Identity SDK is vulnerable to remote code execution.

---

Azure Identity Library for .NET Information Disclosure Vulnerability

CVE-2024-29992 / GHSA-wvxc-855f-jvrv

More information

Details

Azure Identity Library for .NET Information Disclosure Vulnerability

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-29992
• https://github.com/Azure/azure-sdk-for-net
• https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md#1110-2024-04-09
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29992

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Azure Identity SDK Remote Code Execution Vulnerability

CVE-2023-36414 / GHSA-5mfx-4wcx-rv27

More information

Details

Azure Identity SDK is vulnerable to remote code execution.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-36414
• https://github.com/Azure/azure-sdk-for-net
• https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md#1102-2023-10-10
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36414

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

CVE-2024-35255 / GHSA-m5vv-6r4h-3vj9 / GO-2024-2918

More information

Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-35255
• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340
• https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499
• https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d
• https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492
• https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53
• https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

CVE-2020-28500

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Steps to reproduce (provided by reporter Liyuan Chen):

var lo = require('lodash');

function build_blank(n) {
    var ret = "1"
    for (var i = 0; i < n; i++) {
        ret += " "
    }
    return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s) 
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);

CVE-2021-23337

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

---

Regular Expression Denial of Service (ReDoS) in lodash

CVE-2020-28500 / GHSA-29mw-wpgm-hmr9 / SNYK-JAVA-ORGFUJIONWEBJARS-1074896 / SNYK-JAVA-ORGWEBJARS-1074894 / SNYK-JAVA-ORGWEBJARSBOWER-1074892 / SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895 / SNYK-JAVA-ORGWEBJARSNPM-1074893 / SNYK-JS-LODASH-1018905

More information

Details

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Steps to reproduce (provided by reporter Liyuan Chen):

var lo = require('lodash');

function build_blank(n) {
    var ret = "1"
    for (var i = 0; i < n; i++) {
        ret += " "
    }
    return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s) 
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-28500
• https://github.com/lodash/lodash/pull/5065
• https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
• https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://snyk.io/vuln/SNYK-JS-LODASH-1018905
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
• https://security.netapp.com/advisory/ntap-20210312-0006
• https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
• https://github.com/lodash/lodash
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Command Injection in lodash

CVE-2021-23337 / GHSA-35jh-r3h4-6jhm / SNYK-JAVA-ORGFUJIONWEBJARS-1074932 / SNYK-JAVA-ORGWEBJARS-1074930 / SNYK-JAVA-ORGWEBJARSBOWER-1074928 / SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931 / SNYK-JAVA-ORGWEBJARSNPM-1074929 / SNYK-JS-LODASH-1040724

More information

Details

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Severity

• CVSS Score: 7.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-23337
• https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://snyk.io/vuln/SNYK-JS-LODASH-1040724
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
• https://security.netapp.com/advisory/ntap-20210312-0006
• https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
• https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
• https://github.com/lodash/lodash
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

Azure/azure-sdk-for-net (Azure.Identity)

v1.11.4

Compare Source

1.11.4 (2024-06-10)

Bugs Fixed

• Managed identity bug fixes

v1.11.3

Compare Source

1.11.3 (2024-05-07)

Bugs Fixed

• Fixed a regression in DefaultAzureCredential probe request behavior for IMDS managed identity environments. #​43796

v1.11.2

Compare Source

1.11.2 (2024-04-19)

Bugs Fixed

• Fixed an issue which caused claims to be incorrectly added to confidential client credentials such as DeviceCodeCredential #​43468

v1.11.1

Compare Source

1.11.1 (2024-05-07)

Other Changes

• Updated Microsoft.Identity.Client and related dependencies to version 4.60.3

v1.11.0

Compare Source

1.11.0 (2024-04-09)

Bugs Fixed

• AzurePowerShellCredential now handles the case where it falls back to legacy PowerShell without relying on the error message string.

Breaking Changes

• DefaultAzureCredential now sends a probe request with no retries for IMDS managed identity environments to avoid excessive retry delays when the IMDS endpoint is not available. This should improve credential chain resolution for local development scenarios. See BREAKING_CHANGES.md.

v1.10.4

Compare Source

1.10.4 (2023-11-13)

Other Changes

• Distributed tracing with ActivitySource is stable and no longer requires the Experimental feature-flag.

v1.10.3

Compare Source

1.10.3 (2023-10-18)

Bugs Fixed

• ManagedIdentityCredential will now correctly retry when the instance metadata endpoint returns a 410 response. #​28568

Other Changes

• Updated Microsoft.Identity.Client dependency to version 4.56.0

v1.10.2

Compare Source

1.10.2 (2023-10-10)

Bugs Fixed

• Bug fixes for development time credentials.

v1.10.1

Compare Source

1.10.1 (2023-09-12)

Bugs Fixed

• ManagedIdentityCredential will fall through to the next credential in the chain in the case that Docker Desktop returns a 403 response when attempting to access the IMDS endpoint. #​38218
• Fixed an issue where interactive credentials would still prompt on the first GetToken request even when the cache is populated and an AuthenticationRecord is provided. #​38431

v1.10.0

Compare Source

1.10.0 (2023-08-14)

Features Added

• Added BrowserCustomization property to InteractiveBrowserCredential to enable web view customization for interactive authentication.

Bugs Fixed

• ManagedIdentityCredential will no longer attempt to parse invalid json payloads on responses from the managed identity endpoint.
• Fixed an issue where AzurePowerShellCredential fails to parse the token response from Azure PowerShell. #​22638

lodash/lodash (lodash)

v4.17.21

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.