azure-pipelines-tasks: [BUG]: Azure App Service Deploy task using the older version of 7zip, required to be use 18.0.0.0 or higher
Task name
No response
Task version
No response
Environment type (Please select at least one enviroment where you face this issue)
- Self-Hosted
- Microsoft Hosted
- VMSS Pool
- Container
Azure DevOps Server type
dev.azure.com (formerly visualstudio.com)
Azure DevOps Server Version (if applicable)
No response
Operation system
windows 64
Task log
NA
Relevant log output
NA
Aditional info
Our infrastructure team has detected some high-vulnerability issues related to 7zip. We are executing a task in our pipeline called Azure App Service Deploy. Under this, we have an AzureRmWebAppDeployment task which contains 7zip executable and that is having an older version that is 16.0.0.0 and we require 18.0.0.0 or higher as per issue reported.
We have this CVE finding (CVE-2023-40481, CVE-2017-17969, CVE-2018-5996) against same issue for listed below various tasks.
For an example AzureRmWebAppDeployment task which is part of azure-pipelines-tasks-utility-common : https://www.npmjs.com/package/azure-pipelines-tasks-utility-common,
Which is reported for lower version of 7zip. Along with this it should be fix for other below listed task as well so we should not get reported with new vulnerability. we already raised support tickets with Microsoft where we got to know that this should be reported on Github support to fix on priority.
The fixing of this issue should be time bound since we can not carry the same vulnerability for longer period in our vm its should be fix in very high priority.
List of tasks which are reported for 7zip tool contain lower version.
AzureRmWebAppDeployment
PowerShell
NuGetCommand
UseDotNet
DotNetCoreCLI
NuGetToolInstaller
FileTransform
Npm
AzurePowerShell
About this issue
- Original URL
- State: open
- Created 8 months ago
- Comments: 15 (7 by maintainers)
Hi, you cannot force push the latest version, you need to wait for new version to be deployed on all regions.
Hi, @prafullakokadwar123, the tasks which own akvelon-build-task team are fixed(e.g. Powershell) and will be rolled out soon. Pinging @v-mohithgc as a task owner of a bunch of the tasks