Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

azure-cli

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1PyPIAmendedPublished

    Improper Control of Generation of Code ('Code Injection') in Azure CLI

    CVE-2022-39327 · GHSA-47xc-9rr2-q7p4

    Affected
    • PyPI azure-cli < 2.40.0
    Fixed in
    2.40.0· Vendor fix available
    Issue
    In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. For example: Application X is a web application with a feature that allows users to create Secrets in an Azure KeyVault. Instead of constructing API calls based on user input, Application X uses Azure CLI commands to create the secrets. Application X has input fields presented to the user and the Azure CLI command parameter values are filled based on the user input fields. This input, when formed correctly, could potentially be run as system commands. Below is an example of the resulting Azure CLI command run on the web app's hosting machine. The above command could potentially run the whoami command on the hosting machine. Interactive, in-terminal use and automation/pipeline scenarios have not been identified as critical risk scenarios.…

    Recommended action: Upgrade to 2.40.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →