Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI     contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs     an Azure CLI command where parameter values have been provided by an external source. The vulnerability is     only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell     and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met,     this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a     mitigation for the vulnerability. (CVE-2022-39327)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI
    contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs
    an Azure CLI command where parameter values have been provided by an external source. The vulnerability is
    only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell
    and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met,
    this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a
    mitigation for the vulnerability. (CVE-2022-39327)

ID	Name	Product	Family	Severity
257047	Linux Distros Unpatched Vulnerability : CVE-2022-39327	Nessus	Misc.	critical
410033	SCA: security update for azure-cli (GHSA-47xc-9rr2-q7p4)	Tenable Cloud Security	SCA Checks	critical
410033	SCA: security update for azure-cli (GHSA-47xc-9rr2-q7p4)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2022-39327

critical

Tenable Plugins

critical

critical

critical