Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Please clarify which commit fixes CVE-2025-24049 #31036

Open
glaubitz opened this issue Mar 14, 2025 · 4 comments
Open

Please clarify which commit fixes CVE-2025-24049 #31036

glaubitz opened this issue Mar 14, 2025 · 4 comments
Assignees
@bebound @jsntcy
Labels
Azure CLI Team The command of the issue is owned by Azure CLI team customer-reported Issues that are reported by GitHub users external to the Azure organization. needs-triage This is a new issue that needs to be triaged to the appropriate team. Security-Issue
Milestone
Backlog

Comments

@glaubitz
Copy link

Type of issue

Missing information

Reference command name

N/A

Feedback

Microsoft's security tracker reports that there was the CVE-2025-24049 [1] in Azure CLI up to excluding 2.69.0 but there is not a single clue what particular commit fixes this CVE.

Without knowing the exact commit, it is not possible for Linux distributions to address a particular CVE.

Please note that especially enterprise distributions can't always simply upgrade to the latest upstream version as such a process is more involved and complicated since it involves a lot of QA testing.

Can you therefore please disclose what particular commit fixed CVE-2025-24049?

Thanks!

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24049

Page URL

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24049

Content source URL

No response

Author

No response

Document Id

No response
@glaubitz glaubitz added the needs-triage This is a new issue that needs to be triaged to the appropriate team. label Mar 14, 2025
@yonzhan
Copy link
Collaborator

yonzhan commented Mar 14, 2025

Thank you for opening this issue, we will look into it.

@github-actions GitHub Actions
Copy link

This issue is related to security. Please pay attention.

Powered by issue-sentinel

@microsoft-github-policy-service microsoft-github-policy-service bot added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Mar 14, 2025
@yonzhan yonzhan added the Azure CLI Team The command of the issue is owned by Azure CLI team label Mar 14, 2025
@yonzhan yonzhan added this to the Backlog milestone Mar 14, 2025
@AllyW
Copy link
Member

AllyW commented Mar 14, 2025

@glaubitz Please check #30703 for resolving of CVE-2025-24049

@glaubitz
Copy link
Author

@glaubitz Please check #30703 for resolving of CVE-2025-24049

Oh wow, I would have never guessed from the commit message that this particular change fixes a CVE.

It should definitely be documented to help distributions address this CVE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bebound bebound

@jsntcy jsntcy

Labels
Azure CLI Team The command of the issue is owned by Azure CLI team customer-reported Issues that are reported by GitHub users external to the Azure organization. needs-triage This is a new issue that needs to be triaged to the appropriate team. Security-Issue
Projects
None yet
Milestone
Backlog
Development

No branches or pull requests
5 participants
@glaubitz @bebound @AllyW @jsntcy @yonzhan