Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Critical Bug Advisory: Authentication Failures #377

Open
pemari-msft opened this issue Dec 31, 2020 · 2 comments
Open

Critical Bug Advisory: Authentication Failures #377

pemari-msft opened this issue Dec 31, 2020 · 2 comments

Comments

@pemari-msft
Copy link
Member

pemari-msft commented Dec 31, 2020 •
edited by vinjiang

Due to a latent bug in the CPP REST SDK, date strings are being incorrectly generated as a part of storage requests. This means that requests originating today, 31 December 2020 (UTC) will see persistent 403 errors returned from the storage service. The fix in the underlying CPP REST SDK is being released (2.10.17). Please upgrade your dependency on CPP REST SDK to 2.10.17 ASAP to mitigate this issue according to the instructions in the comment below. Bearer token authentication is not affected. The issue will also self-mitigate on 1 Jan 2021. We apologize for the inconvenience.
@vinjiang vinjiang pinned this issue Dec 31, 2020
@vinjiang
Copy link
Member

To apply the fix in your application,

  • If you're using vcpkg to install azure-storage-cpp package, we recommend you upgrade vcpkg to latest and reinstall azure-storage-cpp and cpprestsdk. Note that this will also upgrade azure-storage-cpp to the latest version of 7.5.0.
  • If you build azure-storage-cpp and cpprest from source code by yourself. You should download the latest cpprest sdk (2.10.17), build and overwrite the older version. You don't need to upgrade azure-storage-cpp package in this case.

@rhythmnewt
Copy link

Thank you for this solution. We're working on rolling out a fix in our environments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@rhythmnewt @pemari-msft @vinjiang