CVE-2022-39327
Improper Control of Generation of Code ('Code Injection') in Azure CLI
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut GHSA (hoch).
Beschreibung
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | azure-cli | 2.40.0 |
| pip::GitHub Security Advisory pip | azure-cli | 2.40.0 |
Referenzen
- https://github.com/Azure/azure-cli
- https://github.com/Azure/azure-cli/pull/23514
- https://github.com/Azure/azure-cli/pull/24015
- https://github.com/Azure/azure-cli/security/advisories/GHSA-47xc-9rr2-q7p4
- https://github.com/pypa/advisory-database/tree/main/vulns/azure-cli/PYSEC-2022-43177.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2022-39327