FluentStorage.Azure.Blobs - vulnerable package dependencies

[dammitjanet]

Installing the latest version of FluentStorage.Azure.Blobs (5.2.2) shows that there are two dependencies with vulnerabilities as per the VS Nuget analysis

• Azure.Identity >= 1.1.0 - all versions up to and including 1.10.1 are vulnerable Azure Identity SDK Remote Code Execution Vulnerability
• System.Text.RegularExpressions 4.3.0 - is a dependency in the downstream chain for the item above Regular Expression Denial of Service in System.Text.RegularExpressions

Mitigation

• Install the Azure.Identity (>= 1.10.2) package directly in any project using FluentStorage.Azure.Blobs

Resolution

• Modify the FluentStorage.Azure.Blobs package to require a minimum version of 1.10.2 or higher