CVE-2022-39327
Description
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.
How to fix
- microsoft azure_command-line_interface2.40.0 or later
- azure-cli2.40.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft azure_command-line_interface | v < 2.40.0 | 2.40.0 |
| azure-cliPyPI | v < 2.40.0 | 2.40.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.