Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1tNXZ2LTZyNGgtM3ZqOc4AA88w
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.
Permalink: https://github.com/advisories/GHSA-m5vv-6r4h-3vj9JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNXZ2LTZyNGgtM3ZqOc4AA88w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: about 1 month ago
CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-m5vv-6r4h-3vj9, CVE-2024-35255
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-35255
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255
- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499
- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492
- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178
- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d
- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53
- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340
- https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
Blast Radius: 78.6
Affected Packages
nuget:Microsoft.Identity.Client
Dependent packages: 328Dependent repositories: 0
Downloads: 1,111,666,596 total
Affected Version Ranges: >= 4.61.0, < 4.61.3, >= 4.49.1, < 4.60.4
Fixed in: 4.61.3, 4.60.4
All affected versions: 4.49.1, 4.50.0, 4.51.0, 4.52.0, 4.53.0, 4.54.0, 4.54.1, 4.55.0, 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.59.1, 4.60.0, 4.60.1, 4.60.2, 4.60.3, 4.61.0, 4.61.1, 4.61.2
All unaffected versions: 2.6.1, 2.6.2, 2.7.0, 2.7.1, 3.0.8, 3.0.9, 4.0.0, 4.1.0, 4.2.0, 4.2.1, 4.3.0, 4.3.1, 4.4.0, 4.5.0, 4.5.1, 4.6.0, 4.7.0, 4.7.1, 4.8.0, 4.8.1, 4.8.2, 4.9.0, 4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.14.0, 4.15.0, 4.16.0, 4.16.1, 4.17.0, 4.17.1, 4.17.2, 4.18.0, 4.19.0, 4.20.0, 4.20.1, 4.21.0, 4.21.1, 4.22.0, 4.23.0, 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.27.1, 4.28.0, 4.28.1, 4.29.0, 4.30.0, 4.30.1, 4.31.0, 4.32.0, 4.32.1, 4.33.0, 4.34.0, 4.35.0, 4.35.1, 4.36.0, 4.36.1, 4.36.2, 4.37.0, 4.38.0, 4.39.0, 4.40.0, 4.41.0, 4.42.0, 4.42.1, 4.43.0, 4.43.1, 4.43.2, 4.44.0, 4.45.0, 4.46.0, 4.46.1, 4.46.2, 4.47.0, 4.47.1, 4.47.2, 4.48.0, 4.48.1, 4.49.0, 4.60.4, 4.61.3, 4.62.0, 4.63.0, 4.64.0
maven:com.microsoft.azure:msal4j
Dependent packages: 52Dependent repositories: 336
Downloads:
Affected Version Ranges: >= 1.14.4-beta, < 1.15.1
Fixed in: 1.15.1
All affected versions: 1.14.4-beta, 1.15.0
All unaffected versions: 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.8.0, 1.8.1, 1.9.0, 1.9.1, 1.10.0, 1.10.1, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.12.0, 1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4, 1.13.5, 1.13.6, 1.13.7, 1.13.8, 1.13.9, 1.13.10, 1.14.0, 1.14.1, 1.14.2, 1.14.3, 1.15.1, 1.16.0, 1.16.1, 1.16.2, 1.17.0
npm:@azure/msal-node
Dependent packages: 193Dependent repositories: 8,050
Downloads: 12,717,057 last month
Affected Version Ranges: >= 2.7.0, < 2.9.2
Fixed in: 2.9.2
All affected versions: 2.7.0, 2.8.0, 2.8.1, 2.9.0, 2.9.1
All unaffected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.9.1, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.13.0, 1.14.0, 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.15.0, 1.16.0, 1.17.0, 1.17.1, 1.17.2, 1.17.3, 1.18.0, 1.18.1, 1.18.2, 1.18.3, 1.18.4, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.9.2, 2.10.0, 2.11.0, 2.11.1, 2.12.0, 2.13.0, 2.13.1
nuget:Azure.Identity
Dependent packages: 738Dependent repositories: 0
Downloads: 586,797,358 total
Affected Version Ranges: < 1.11.4
Fixed in: 1.11.4
All affected versions: 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.4.0, 1.4.1, 1.5.0, 1.6.0, 1.6.1, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 1.9.0, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.11.0, 1.11.1, 1.11.2, 1.11.3
All unaffected versions: 1.11.4, 1.12.0
go:github.com/Azure/azure-sdk-for-go/sdk/azidentity
Dependent packages: 2,996Dependent repositories: 4,673
Downloads:
Affected Version Ranges: < 1.6.0
Fixed in: 1.6.0
All affected versions: 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.5.0, 0.6.0, 0.6.1, 0.7.0, 0.7.1, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.13.1, 0.13.2, 0.14.0, 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.4.0, 1.5.0, 1.5.1
All unaffected versions:
maven:com.azure:azure-identity
Dependent packages: 330Dependent repositories: 710
Downloads:
Affected Version Ranges: < 1.12.2
Fixed in: 1.12.2
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.6.0, 1.6.1, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.9.0, 1.9.1, 1.9.2, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.12.0, 1.12.1
All unaffected versions: 1.12.2, 1.13.0, 1.13.1, 1.13.2
npm:@azure/identity
Dependent packages: 990Dependent repositories: 6,628
Downloads: 11,602,293 last month
Affected Version Ranges: < 4.2.1
Fixed in: 4.2.1
All affected versions: 1.0.0, 1.0.2, 1.0.3, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.1.0, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.1, 3.4.2, 4.0.0, 4.0.1, 4.1.0, 4.2.0
All unaffected versions: 4.2.1, 4.3.0, 4.4.0, 4.4.1
pypi:azure-identity
Dependent packages: 408Dependent repositories: 4,836
Downloads: 64,610,139 last month
Affected Version Ranges: < 1.16.1
Fixed in: 1.16.1
All affected versions: 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.6.0, 1.6.1, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.14.1, 1.15.0, 1.16.0
All unaffected versions: 1.16.1, 1.17.0, 1.17.1