Please publish updated image, mcr.microsoft.com/azure-cli:2.49.0 contains vulnerabilities #26695
Labels
Azure CLI Team
The command of the issue is owned by Azure CLI team
customer-reported
Issues that are reported by GitHub users external to the Azure organization.
feature-request
Milestone
Related command
No response
Resource Provider
N/A
Description of Feature or Work Requested
Hi azure-cli team,
We'd like to use mcr.microsoft.com/azure-cli:2.49.0 (sha256:a30f6eb2d5f8f6c69100bb4a91e7de465d784332dfd7206448185754b9e9fde2, published 05/23/2023) in our product, however it contains known vulnerabilities.
Using the 2.49.0 tag would put us in violation of Microsoft Security policies as some of these vulnerabilities are older than 30 days (SLA defines 30 days as a period when patches need to be applied since vulnerability disclosure).
I'm listing them here:
I forked azure-cli repo, made changes to Dockerfile and published our own image to our ACR. Still, we'd like to consume the image from MCR as that's the guidance we should follow.
Feel free to get in touch with me on further details.
Regards,
Ondrej
Minimum API Version Required
N/A
Swagger PR link / SDK link
N/A
Request Example
No response
Target Date
2023-06-22
Additional context
No response
The text was updated successfully, but these errors were encountered: