[BUG] Microsoft.Azure.Functions.Worker.Extensions.ServiceBus generates references to NuGet packages with known vulnerablities about azure-functions-dotnet-worker HOT 17 CLOSED

That CVE is wrong. Grpc.Net.Client and Grpc.AspNetCore.Server aren't impacted. The .NET HTTP/2 implementation is different.

Can you please give feedback to whoever says those packages are vulnerable that they're wrong and fix their mistake.

from azure-functions-dotnet-worker.

@seancostigan The servicebus extension package version you mentioned does not have any vulnerabilities. But I see your Microsoft.NET.Sdk.Functions package is not the latest version. Can you please update Microsoft.Azure.Functions.Worker.Sdk package to the latest stable version in your function app project? That should bring the latest version of Microsoft.NET.Sdk.Functions package in the auto genreated WorkerExtensions project. This should solve your issue.

Let us know if you are still experiencing any issues. Thanks!

from azure-functions-dotnet-worker.

@kshyju I updated Microsoft.Azure.Functions.Worker.Sdk to the latest version (1.17.1) and that did update Microsoft.NET.Sdk.Functions to 4.3.0 in the WorkerExtensions.csproj

Here are the package references now in WorkerExtensions.csproj:

<ItemGroup>
    <PackageReference Include="Microsoft.NETCore.Targets" Version="3.0.0" PrivateAssets="all" />
    <PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.3.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.ServiceBus" Version="5.13.5" />
</ItemGroup>

However, in the bin/Debug/net8.0/.azurefunctions folder for my Azure Function, it is still referencing the two vulnerable Grpc NuGet packages. I believe those are being pulled in by Microsoft.Azure.WebJobs.Extensions.ServiceBus, so I think that is the package that needs to be updated.

from azure-functions-dotnet-worker.

Microsoft.Azure.WebJobs.Extensions.ServiceBus 5.13.5 does not have any vulnerabilities. You can verify this by creating a project which has a reference to this package and then run dotnet list package --vulnerable --include-transitive.

Try a dotnet clean and see that helps? Can you run dotnet list package --vulnerable --include-transitive on the auto generated WorkerExtensions project and share what it reports? If it reports any warnings, let's take a binary search approach to narrow down the culprit entry. Try removing half of the package reference entries and execute the command again. try the binary search approach until you find out the package reference entry which is causing the error. Please share what you find.

from azure-functions-dotnet-worker.

I ran the dotnet list package --vulnerable --include-transitive command on my project and I get the same results as you (no vulnerable packages). However, the vulnerability scanning tool integrated with my pipeline is reporting two vulnerabilities.

Both are related to this item: https://nvd.nist.gov/vuln/detail/CVE-2023-32731

from azure-functions-dotnet-worker.

Looks like some other package your project references is causing the issue. Can you share all the package references you have? Can you make sure all of them are the latest stable versions?

from azure-functions-dotnet-worker.

I confirmed all the directly referenced packages in my project are at the latest version:

<ItemGroup>
  <FrameworkReference Include="Microsoft.AspNetCore.App" />
  <PackageReference Include="Microsoft.Azure.Functions.Worker" Version="1.21.0" />
  <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.1.0" />
  <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="1.2.1" />
  <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.ServiceBus" Version="5.17.0" />
  <PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="1.17.1" />
  <PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="2.22.0" />
  <PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="1.2.0" />
</ItemGroup>

Looking at the WorkerExtensions project, I see that the Grpc.AspNetCore.Server and Grpc.Net.Client packages are being pulled in as transitive dependencies from Microsoft.Azure.WebJobs.Extensions.ServiceBus

from azure-functions-dotnet-worker.

Hm, that is strange, with the nuget command, I still do not see any vulnerability issues being reported for Grpc.Net.Client 2.49.0 when trying in a console app.

May I ask what scanning tool you have in your CI?

from azure-functions-dotnet-worker.

We are using Aqua

from azure-functions-dotnet-worker.

@seancostigan I do not see any information in the linked CVE page which says the Grpc.Net.Client 2.49.0 version is impacted. Can you point me to the page which has this information?

from azure-functions-dotnet-worker.

AquaSec's (Who makes Trivy) vulnerability team associated the issue with the base upstream GRPC source to the NuGet packages. Aqua's page is here: https://avd.aquasec.com/nvd/2023/cve-2023-32731/

That public page contains the same information as NVD. Their tooling reports that the issue also impacts Grpc.Net.Client and Grpc.AspNetCore.Server.

The following are the information blocks from the AquaSec Scanner reported in the UI:

from azure-functions-dotnet-worker.

Tagging @mattchenderson for further help on next steps here.

from azure-functions-dotnet-worker.

Any progress on this issue or plans on doing anything with it?

from azure-functions-dotnet-worker.

@JamesNK could you comment on this CVE that reportedly comes from gRPC packages? Nuget does not have any vulnerability reported for those package versions. Does this CVE not apply here? Was it an oversight to not flag those nuget packages as vulnerable?

from azure-functions-dotnet-worker.

I got a notification about this issue being marked as stale and needing a response to keep it from being closed. So responding here, but I think @jviau captured the open question in the response above.

from azure-functions-dotnet-worker.

@JamesNK Thank you for confirming that there is no issue with these packages. I have relayed the information to my Product Security team and they are going to work with AquaSec to identify this as a false positive.

from azure-functions-dotnet-worker.

Closing this as resolved/no action.

from azure-functions-dotnet-worker.