Azure / Azure/azure-powershell
AZ module 11.1.0 is vulnerable to CVE-2021-26701
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
We cannot add AZ module to our buildagent because it is vulnerable to CVE-2021-26701. It has to do with this package system.text.encodings.web version 4.6.0 but fixed in version 4.7.2 and above.

adding this link for more context https://github.com/dotnet/runtime/issues/49377
**PowerShell Version: 7.3.6**
# Install PowerShell
RUN wget https://github.com/PowerShell/PowerShell/releases/download/v7.3.6/powershell_7.3.6-1.deb_amd64.deb
RUN dpkg -i powershell_7.3.6-1.deb_amd64.deb
RUN rm -f powershell_7.3.6-1.deb_amd64.deb
**AZ Version: 11.1.0**
RUN pwsh -c "Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted"
RUN pwsh -c "Install-Module -Name Az -RequiredVersion 11.1.0 -Scope AllUsers"
**Base Image**
ubuntu:20.04
### Issue script & Debug output
```PowerShell
Scan result attached to the description section
```
### Environment data
```PowerShell
powershell version is 7.3.6
```
### Module versions
```PowerShell
az module version is 11.1.0
```
### Error output
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.