Skip to content

Commit 5a245ca

Browse files
msJinLeiisra-fel
msJinLei
and
isra-fel
authored
Upgrade Azure.Idenntity to 1.12.0 For CVE (#25318)
* Upgrade Azure.Identity for CVE * Integrate new MSAL runtime to fix WAM popup window issue * Update the reference of Authentication.csproj and ChangeLog.md * Fix Azure.Core.AccessToken used before assigned issue * Address review comments * Update src/Accounts/Accounts/ChangeLog.md Co-authored-by: Yeming Liu <[email protected]> --------- Co-authored-by: Yeming Liu <[email protected]>
1 parent c75fd83 commit 5a245ca

19 files changed

+64
-46
lines changed

‎src/Accounts/Accounts/ChangeLog.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Fixed [CVE-2024-35255](https://github.com/advisories/GHSA-m5vv-6r4h-3vj9)
23+
* Updated `Microsoft.Identity.Client.NativeInterop` to fix the WAM pop window issue in elevated mode [#24967]
2224
* Updated the reference of Azure PowerShell Common to 1.3.98-preview.
2325
* Limited promotional message to interactive scenarios only
2426

‎src/Accounts/AssemblyLoading/ConditionalAssemblyProvider.cs

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,14 @@ public static void Initialize(string rootPath, IConditionalAssemblyContext conte
4242
// todo: add a tool to update assembly versions after replacing the assemblies. (Can it support newly introduced assemblies?)
4343
// todo: consider moving the list to a standalone config file
4444
#region AssemblyList
45-
CreateAssembly("netstandard2.0", "Azure.Core", "1.38.0.0"),
46-
CreateAssembly("netstandard2.0", "Azure.Identity", "1.11.2.0"),
45+
CreateAssembly("netstandard2.0", "Azure.Core", "1.40.0.0"),
46+
CreateAssembly("netstandard2.0", "Azure.Identity", "1.12.0.0"),
4747
CreateAssembly("netstandard2.0", "Azure.Identity.Broker", "1.1.0.0"),
4848
CreateAssembly("netstandard2.0", "Microsoft.Bcl.AsyncInterfaces", "1.0.0.0"),
49-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client", "4.60.3.0"),
50-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Extensions.Msal", "4.60.3.0"),
51-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Broker", "4.60.3.0"),
52-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.NativeInterop", "0.16.0.0"),
49+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client", "4.61.3.0"),
50+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Extensions.Msal", "4.61.3.0"),
51+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Broker", "4.61.3.0"),
52+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.NativeInterop", "0.16.2.0"),
5353
CreateAssembly("netstandard2.0", "Microsoft.IdentityModel.Abstractions", "6.35.0.0"),
5454
CreateAssembly("netstandard2.0", "System.ClientModel", "1.0.0.0"),
5555
CreateAssembly("netstandard2.0", "System.Memory.Data", "1.0.2.0"),

‎src/Accounts/Authentication/Authentication.csproj

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@
1212
</PropertyGroup>
1313

1414
<ItemGroup>
15-
<PackageReference Include="Azure.Identity" Version="1.11.2" />
15+
<PackageReference Include="Azure.Identity" Version="1.12.0" />
1616
<PackageReference Include="Azure.Identity.Broker" Version="1.1.0" />
17-
<PackageReference Include="Microsoft.Identity.Client" Version="4.60.3" />
18-
<PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.60.3" />
19-
<PackageReference Include="Microsoft.Identity.Client.Broker" Version="4.60.3"/>
17+
<PackageReference Include="Microsoft.Identity.Client" Version="4.61.3" />
18+
<PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.61.3" />
19+
<PackageReference Include="Microsoft.Identity.Client.Broker" Version="4.61.3"/>
2020
</ItemGroup>
2121

2222
<ItemGroup>

‎src/CosmosDB/CosmosDB/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Fixed the issue that Azure.Core.AccessToken is used before assigned.
2223

2324
## Version 1.14.3
2425
* Removed the out-of-date breaking change message for `Get-AzCosmosDBAccountKey`.

‎src/CosmosDB/CosmosDB/Helpers/CosmosDBSessionCredential.cs

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -47,24 +47,28 @@ public CosmosDBSessionCredential(IAzureContext defaultContext, string endPointRe
4747

4848
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
4949
{
50-
AccessToken token;
51-
this.accessToken.AuthorizeRequest((tokenType, tokenValue) =>
50+
DateTimeOffset expiresOn;
51+
string token = string.Empty;
52+
accessToken.AuthorizeRequest((tokenType, tokenValue) =>
5253
{
53-
token = new AccessToken(tokenValue, DateTimeOffset.UtcNow);
54+
token = tokenValue;
55+
expiresOn = DateTimeOffset.UtcNow;
5456
});
5557

56-
return token;
58+
return new AccessToken(token, expiresOn);
5759
}
5860

5961
public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
6062
{
61-
AccessToken token;
62-
this.accessToken.AuthorizeRequest((tokenType, tokenValue) =>
63+
DateTimeOffset expiresOn;
64+
string token = string.Empty;
65+
accessToken.AuthorizeRequest((tokenType, tokenValue) =>
6366
{
64-
token = new AccessToken(tokenValue, DateTimeOffset.UtcNow);
67+
token = tokenValue;
68+
expiresOn = DateTimeOffset.UtcNow;
6569
});
6670

67-
return new ValueTask<AccessToken>(token);
71+
return new ValueTask<AccessToken>(new AccessToken(token, expiresOn));
6872
}
6973
}
7074
}

‎src/Storage/Storage.Management/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Fixed the issue that Azure.Core.AccessToken is used before assigned.
2122
* Supported TLS1_3 when creating and updating a storage account
2223
- `New-AzStorageAccount`
2324
- `Set-AzStorageAccount`

‎src/Storage/Storage/Common/AzureSessionCredential.cs

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
using System;
2-
using System.Collections.Generic;
3-
using System.Text;
4-
using System.Threading;
5-
using System.Threading.Tasks;
6-
using Azure.Core;
1+
using Azure.Core;
2+
73
using Microsoft.Azure.Commands.Common.Authentication;
84
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
95

6+
using System;
7+
using System.Threading;
8+
using System.Threading.Tasks;
9+
1010
namespace Microsoft.WindowsAzure.Commands.Storage.Common
1111
{
1212
public delegate void DebugLogWriter(string log);
@@ -51,33 +51,37 @@ public AzureSessionCredential(IAzureContext DefaultContext, DebugLogWriter logWr
5151

5252
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
5353
{
54-
AccessToken token;
54+
DateTimeOffset expiresOn;
55+
string token = string.Empty;
5556
accessToken.AuthorizeRequest((tokenType, tokenValue) =>
5657
{
57-
token = new AccessToken(tokenValue, DateTimeOffset.UtcNow);
58+
token = tokenValue;
59+
expiresOn = DateTimeOffset.UtcNow;
5860
});
5961
#if DEBUG
6062
if (this.debugLogWriter != null)
6163
{
62-
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetToken: " + token.Token);
64+
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetToken: " + token);
6365
}
6466
#endif
65-
return token;
67+
return new AccessToken(token, expiresOn);
6668
}
6769

6870
public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
6971
{
70-
AccessToken token;
72+
DateTimeOffset expiresOn;
73+
string token = string.Empty;
7174
accessToken.AuthorizeRequest((tokenType, tokenValue) =>
7275
{
73-
token = new AccessToken(tokenValue, DateTimeOffset.UtcNow);
76+
token = tokenValue;
77+
expiresOn = DateTimeOffset.UtcNow;
7478
});
7579

7680
if (this.debugLogWriter != null)
7781
{
78-
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetTokenAsync: " + token.Token);
82+
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetTokenAsync: " + token);
7983
}
80-
return new ValueTask<AccessToken>(token);
84+
return new ValueTask<AccessToken>(new AccessToken(token, expiresOn));
8185
}
8286

8387
private IAzureEnvironment EnsureStorageOAuthAudienceSet(IAzureEnvironment environment)

‎src/Synapse/Synapse/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Fixed the issue that Azure.Core.AccessToken is used before assigned.
2223

2324
## Version 3.0.8
2425
* Upgraded `Microsoft.DataTransfer.Gateway.Encryption` to `5.29.8499.2`

‎src/Synapse/Synapse/Common/AzureSessionCredential.cs

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,16 @@
1212
// limitations under the License.
1313
// ----------------------------------------------------------------------------------
1414

15-
using System;
16-
using System.Collections.Generic;
17-
using System.Text;
18-
using System.Threading;
19-
using System.Threading.Tasks;
2015
using Azure.Core;
16+
2117
using Microsoft.Azure.Commands.Common.Authentication;
2218
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
2319
using Microsoft.Azure.Commands.ResourceManager.Common.Properties;
2420

21+
using System;
22+
using System.Threading;
23+
using System.Threading.Tasks;
24+
2525
namespace Microsoft.Azure.Commands.Synapse.Common
2626
{
2727
public delegate void DebugLogWriter(string log);
@@ -51,31 +51,36 @@ public AzureSessionCredential(IAzureContext DefaultContext, DebugLogWriter logWr
5151

5252
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
5353
{
54-
AccessToken token;
54+
DateTimeOffset expiresOn;
55+
string token = string.Empty;
5556
accessToken.AuthorizeRequest((tokenType, tokenValue) =>
5657
{
57-
token = new AccessToken(tokenValue, DateTimeOffset.UtcNow);
58+
token = tokenValue;
59+
expiresOn = DateTimeOffset.UtcNow;
5860
});
61+
5962
if (this.debugLogWriter != null)
6063
{
61-
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetToken: " + token.Token);
64+
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetToken: " + token);
6265
}
63-
return token;
66+
return new AccessToken(token, expiresOn);
6467
}
6568

6669
public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
6770
{
68-
AccessToken token;
71+
DateTimeOffset expiresOn;
72+
string token = string.Empty;
6973
accessToken.AuthorizeRequest((tokenType, tokenValue) =>
7074
{
71-
token = new AccessToken(tokenValue, DateTimeOffset.UtcNow);
75+
token = tokenValue;
76+
expiresOn = DateTimeOffset.UtcNow;
7277
});
7378

7479
if (this.debugLogWriter != null)
7580
{
76-
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetTokenAsync: " + token.Token);
81+
this.debugLogWriter("[" + DateTime.Now.ToString() + "] GetTokenAsync: " + token);
7782
}
78-
return new ValueTask<AccessToken>(token);
83+
return new ValueTask<AccessToken>(new AccessToken(token, expiresOn));
7984
}
8085

8186
private IAccessToken accessToken;

‎src/lib/netstandard2.0/Azure.Core.dll

21.4 KB
Binary file not shown.

0 commit comments

Comments
 (0)