Update the System.Formats.Asn1 package for Az.CodeSigning module (#25665

) * Update the System.Formats.Asn1 package This fix addresses CVE-2024-38095 * update changelog.md
Azure · Jul 28, 2024 · 445805b · 445805b
1 parent 61507de
commit 445805b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/src/CodeSigning/CodeSigning/ChangeLog.md b/src/CodeSigning/CodeSigning/ChangeLog.md
@@ -19,6 +19,7 @@
 -->
 ## Upcoming Release
 * Added `Get-AzCodeSigningCertChain` cmdlet to retrieve the certificate chain for a certificate profile.
+* Added System.Formats.Asn1 dependency to the module to address a security vulnerability.
 
 ## Version 0.1.2
 * Updated signed 3rd party assembly Polly.dll to PSGallery

diff --git a/src/CodeSigning/CodeSigning/CodeSigning.csproj b/src/CodeSigning/CodeSigning/CodeSigning.csproj
@@ -25,6 +25,7 @@
     <PackageReference Include="Polly" Version="7.2.4" />
     <PackageReference Include="Azure.CodeSigning.Client.CryptoProvider" Version="0.1.16" />
     <PackageReference Include="Azure.CodeSigning.Sdk" Version="0.1.106" />
+    <PackageReference Include="System.Formats.Asn1" Version="6.0.1" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" Version="6.0.3" />
   </ItemGroup>