Azure / Azure/azure-powershell

AZ module 11.1.0 is vulnerable to CVE-2021-26701

Open
#23,669 5 comments 0 reactions 1 assignee Claimed by @msJinLei View on GitHub
bug customer-reported needs-triage
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

We cannot add AZ module to our buildagent because it is vulnerable to CVE-2021-26701. It has to do with this package system.text.encodings.web version 4.6.0 but fixed in version 4.7.2 and above.
![pwsh](https://github.com/Azure/azure-powershell/assets/25059234/3d2c1f65-54f9-4e56-9606-ce5926d5f6c9)

adding this link for more context https://github.com/dotnet/runtime/issues/49377

**PowerShell Version: 7.3.6**

# Install PowerShell
RUN wget https://github.com/PowerShell/PowerShell/releases/download/v7.3.6/powershell_7.3.6-1.deb_amd64.deb
RUN dpkg -i powershell_7.3.6-1.deb_amd64.deb
RUN rm -f powershell_7.3.6-1.deb_amd64.deb

**AZ Version: 11.1.0**
RUN pwsh -c "Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted"
RUN pwsh -c "Install-Module -Name Az -RequiredVersion 11.1.0 -Scope AllUsers"

**Base Image**
ubuntu:20.04

### Issue script & Debug output

```PowerShell
Scan result attached to the description section
```

### Environment data

```PowerShell
powershell version is 7.3.6
```

### Module versions

```PowerShell
az module version is 11.1.0
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.