Vulnerabilities

[nprhl]

Serilog.Sinks.MSSqlServer

Library Vulnerabilities (1)

Severity: Medium
Top Fix: Upgrade to version microsoft.data.sqlclient 5.2.1

[cremor]

Which vulnerability do you mean exactly? SqlClient 5.1.5 is not marked as vulnerable on NuGet.
(I know that a dependency of SqlClient is marked as vulnerable, but this is also true for the currently latest version 5.2.1.)

[MaddMugsy]

Piggybacking on this issue to report two new vulnerabilities reported by VS today:

Azure.Identity 1.1.3 and Microsoft.Identity.Client 4.60.3 are showing up as vulnerable dependencies of Microsoft.Data.SqlClient 5.2.1, which is a dependency of version 6.6.1 of this package.

[ckadluba]

Thank you for reporting this. I made a scan today using dotnet list package --vulnerable --include-transitive and found vulnerability reported by @MaddMugsy and other vulnerabilies. One even with high severity.

Project `Serilog.Sinks.MSSqlServer` has the following vulnerable packages
   [net462]:
   Transitive Package               Resolved   Severity   Advisory URL
   > Azure.Identity                 1.10.3     Moderate   https://github.com/advisories/GHSA-wvxc-855f-jvrv
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
   > Microsoft.Identity.Client      4.56.0     Low        https://github.com/advisories/GHSA-x674-v45j-fwxw
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9

   [net472]:
   Transitive Package               Resolved   Severity   Advisory URL
   > Azure.Identity                 1.10.3     Moderate   https://github.com/advisories/GHSA-wvxc-855f-jvrv
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
   > Microsoft.Identity.Client      4.56.0     Low        https://github.com/advisories/GHSA-x674-v45j-fwxw
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9

   [netstandard2.0]:
   Transitive Package               Resolved   Severity   Advisory URL
   > Azure.Identity                 1.10.3     Moderate   https://github.com/advisories/GHSA-wvxc-855f-jvrv
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
   > Microsoft.Identity.Client      4.56.0     Low        https://github.com/advisories/GHSA-x674-v45j-fwxw
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9

   [net6.0]:
   Transitive Package               Resolved   Severity   Advisory URL
   > Azure.Identity                 1.10.3     Moderate   https://github.com/advisories/GHSA-wvxc-855f-jvrv
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
   > Microsoft.Identity.Client      4.56.0     Low        https://github.com/advisories/GHSA-x674-v45j-fwxw
                                               Moderate   https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
   > System.Formats.Asn1            5.0.0      High       https://github.com/advisories/GHSA-447r-wph3-92pm

After updating Microsoft.Data.SqlClient from 5.1.5 to the latest version 5.2.1, it came down to only the one vulnerability which was reported by @MaddMugsy: GHSA-m5vv-6r4h-3vj9.

It seems that the SqlClient have already merged a PR which fixes the remaining vulnerability (dotnet/SqlClient#2577) on 23rd of June but they have not yet created a new 5.x release. So we will have to wait for that.

In the meantime, to increase the security posture of SQLServer sink, I will create a release with the SqlClient udated to 5.2.1 so we get rid of the high severity and other vulnerability and only GHSA-m5vv-6r4h-3vj9 is remaining. This we will fix as soon as SqlClient makes a new release.

[cremor]

only GHSA-m5vv-6r4h-3vj9 is remaining. This we will fix as soon as SqlClient makes a new release.

@ckadluba FYI, this will also be fixed in SqlClient version 5.1.6, see dotnet/SqlClient#2649

SqlClient 5.1.x has LTS support, while 5.2x only has "current" support. See https://learn.microsoft.com/en-us/sql/connect/ado-net/sqlclient-driver-support-lifecycle
I don't know if that affects this package or how you want to handle this. But I thought that I should mention it since it is the reason that Microsoft.EntityFrameworkCore.SqlServer v8 stays on SqlClient 5.1.x.

[ckadluba]

Thanks for mentioning this. Then probably we should switch back to a 5.1 version as soon as there is a fix.

[cremor]

@ckadluba FYI: dotnet/SqlClient#2568 (comment)

[ckadluba]

@cremor Thank you for the heads up. I'll create a sink version 6.7.1 with SqlClient 5.1.6 soon. This should also fix #552.