Security vulnerability in passport-azure-ad > bunyan > mv > mkdirp > minimist dependency chain

Core Library

Passport Azure AD (passport-azure-ad)

Core Library Version

4.3.1

Wrapper Library

Not Applicable

Wrapper Library Version

None

Description

The following dependency chaining originating in passport-azure-ad introduces a security vulnerability which is getting flagged by GitHub’s Dependabot: passport-azure-ad > bunyan > mv > mkdirp > minimist

The issue was reported to bunyan a while back but it looks like the project’s maintainers have no interest in fixing it (or the resources to do so): https://github.com/trentm/node-bunyan/issues/667

Can you please consider removing passport-azure-ad’s dependency on bunyan in order to eliminate this high severity vulnerability?

Error Message

No response

Msal Logs

No response

MSAL Configuration

N/A

Relevant Code Snippets

N/A

Reproduction Steps

N/A

Expected Behavior

N/A

Identity Provider

Azure AD / MSA

Browsers Affected (Select all that apply)

None (Server)

Regression

No response

Source

Internal (Microsoft)

[erik-neumann]

We’re running into this as well. Various high severity security issues are reported by our code / dependency analysis. This is also affecting almost any of products, and authentication isn’t on of the topics where I would say security is minor important or critical. Any idea of a timeline, or is there any workaround we can implement until this is fixed?

[jasonnutter]

@erik-neumann Thanks for confirming. We are aware of the issues with async and request, so I will close this.