Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bundled Python version has multiple vulnerabilities #26740

Closed
glnbrns opened this issue Jun 23, 2023 · 2 comments · Fixed by #26749
Closed

Bundled Python version has multiple vulnerabilities #26740

glnbrns opened this issue Jun 23, 2023 · 2 comments · Fixed by #26749
Assignees
Labels
Azure CLI Team The command of the issue is owned by Azure CLI team Core CLI core infrastructure customer-reported Issues that are reported by GitHub users external to the Azure organization. feature-request
Milestone

Comments

@glnbrns
Copy link

glnbrns commented Jun 23, 2023

Describe the bug

Release 2.49 installed on Windows with Python.exe version 3.10.10 which has the below 3 vulnerabilities.

CVE-2023-0464 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0464
CVE-2023-0466 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0466
CVE-2023-24329 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24329

image

Related command

az --version

Listed Python version has multiple vulnerabilities

Errors

No error in output. SDK update required.

Issue script & Debug output

No Issue in script . SDK update required.

Expected behavior

The SDK should include the latest python version 3.10.12 which addresses these issues.

https://www.python.org/downloads/release/python-31012/

Environment Summary

azure-cli 2.49.0

core 2.49.0
telemetry 1.0.8

Dependencies:
msal 1.20.0
azure-mgmt-resource 22.0.0

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\gbarnes1.azure\cliextensions'

Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

No response

@glnbrns glnbrns added the bug This issue requires a change to an existing behavior in the product in order to be resolved. label Jun 23, 2023
@ghost ghost added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Jun 23, 2023
@yonzhan
Copy link
Collaborator

yonzhan commented Jun 23, 2023

Thank you for opening this issue, we will look into it.

@yonzhan yonzhan added Azure CLI Team The command of the issue is owned by Azure CLI team Core CLI core infrastructure labels Jun 23, 2023
@yonzhan yonzhan added this to the Backlog milestone Jun 23, 2023
@bebound
Copy link
Contributor

bebound commented Jun 25, 2023

There CVEs are fixed in 3.10.12. Howerver, Python 3.10 is now in the "security fixes only" stage of its life cycle and but Python 3.10.11 was the last full bugfix release of Python 3.10 with binary installers. We can not easily bump to 3.10.12.

I'll try to bump bundled Python to 3.11. Tracked by #24494

Ref: https://www.python.org/downloads/release/python-31012/

@jiasli jiasli changed the title Bundled SDK Python version has multiple vulnerabilities Bundled Python version has multiple vulnerabilities Aug 9, 2023
@yonzhan yonzhan added feature-request and removed bug This issue requires a change to an existing behavior in the product in order to be resolved. labels Aug 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Azure CLI Team The command of the issue is owned by Azure CLI team Core CLI core infrastructure customer-reported Issues that are reported by GitHub users external to the Azure organization. feature-request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants