Azure / Azure/azure-linux-extensions

AMA 1.43 has not yet fixed CVE-2025-68121 on "/usr/bin/azureotelcollector"

Open
#2,191 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

There is CVE-2025-68121 on lower go stdlib. Fixed version are
"1.24.13",
"1.25.7",
"1.26.0-rc.3"

AMA agent 1.43 has /opt/microsoft/azuremonitoragent/bin/telegraf fixed but /usr/bin/azureotelcollector not.

[root@redhat ~]# rpm -qf /opt/microsoft/azuremonitoragent/bin/telegraf
azuremonitoragent-1.43.0-1470.x86_64
[root@redhat ~]# strings /opt/microsoft/azuremonitoragent/bin/telegraf | grep -E "^go1\.[0-9]+\.[0-9]+$"
go1.26.2
go1.26.2
[root@redhat ~]# rpm -qf /usr/bin/azureotelcollector
azureotelcollector-0.0.1-1.azl3.x86_64
[root@redhat ~]# /usr/bin/azureotelcollector --version
**azureotelcollector version 1.20260521.112231**
[root@redhat ~]# strings /usr/bin/azureotelcollector | grep -E "^go1\.[0-9]+\.[0-9]+$"
**go1.25.5
go1.25.5**

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the build or packaging entry point for /usr/bin/azureotelcollector, identified by the azureotelcollector-0.0.1-1.azl3.x86_64 package. Check why it embeds Go 1.25.5 while telegraf uses Go 1.26.2, then verify the resulting binary against the CVE's fixed versions. Done means the packaged azureotelcollector no longer embeds the vulnerable Go standard library.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.