Azure / Azure/azure-linux-extensions
AMA 1.43 has not yet fixed CVE-2025-68121 on "/usr/bin/azureotelcollector"
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
There is CVE-2025-68121 on lower go stdlib. Fixed version are
"1.24.13",
"1.25.7",
"1.26.0-rc.3"
AMA agent 1.43 has /opt/microsoft/azuremonitoragent/bin/telegraf fixed but /usr/bin/azureotelcollector not.
[root@redhat ~]# rpm -qf /opt/microsoft/azuremonitoragent/bin/telegraf
azuremonitoragent-1.43.0-1470.x86_64
[root@redhat ~]# strings /opt/microsoft/azuremonitoragent/bin/telegraf | grep -E "^go1\.[0-9]+\.[0-9]+$"
go1.26.2
go1.26.2
[root@redhat ~]# rpm -qf /usr/bin/azureotelcollector
azureotelcollector-0.0.1-1.azl3.x86_64
[root@redhat ~]# /usr/bin/azureotelcollector --version
**azureotelcollector version 1.20260521.112231**
[root@redhat ~]# strings /usr/bin/azureotelcollector | grep -E "^go1\.[0-9]+\.[0-9]+$"
**go1.25.5
go1.25.5**
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the build or packaging entry point for /usr/bin/azureotelcollector, identified by the azureotelcollector-0.0.1-1.azl3.x86_64 package. Check why it embeds Go 1.25.5 while telegraf uses Go 1.26.2, then verify the resulting binary against the CVE's fixed versions. Done means the packaged azureotelcollector no longer embeds the vulnerable Go standard library.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100