azure-pipelines-tasks: [BUG]: Azure App Service Deploy task using the older version of 7zip, required to be use 18.0.0.0 or higher

Task name

No response

Task version

No response

Environment type (Please select at least one enviroment where you face this issue)

  • Self-Hosted
  • Microsoft Hosted
  • VMSS Pool
  • Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

windows 64

Task log

NA

Relevant log output

NA

Aditional info

Our infrastructure team has detected some high-vulnerability issues related to 7zip. We are executing a task in our pipeline called Azure App Service Deploy. Under this, we have an AzureRmWebAppDeployment task which contains 7zip executable and that is having an older version that is 16.0.0.0 and we require 18.0.0.0 or higher as per issue reported.
We have this CVE finding (CVE-2023-40481, CVE-2017-17969, CVE-2018-5996) against same issue for listed below various tasks.
For an example AzureRmWebAppDeployment task which is part of azure-pipelines-tasks-utility-common : https://www.npmjs.com/package/azure-pipelines-tasks-utility-common, 
Which is reported for lower version of 7zip. Along with this it should be fix for other below listed task as well so we should not get reported with new vulnerability. we already raised support tickets with Microsoft where we got to know that this should be reported on Github support to fix on priority. 

The fixing of this issue should be time bound since we can not carry the same vulnerability for longer period in our vm its should be fix in very high priority. 

List of tasks which are reported for 7zip tool contain lower version.
	
AzureRmWebAppDeployment
PowerShell
NuGetCommand
UseDotNet
DotNetCoreCLI
NuGetToolInstaller
FileTransform
Npm
AzurePowerShell

About this issue

  • Original URL
  • State: open
  • Created 8 months ago
  • Comments: 15 (7 by maintainers)

Most upvoted comments

Anybody have an idea how to force the agent to download the newest version? only getting the old 1.220.0 version form the FileTransform@1 Task. Have deleted the files in _tasks but only getting the old version

Hi, you cannot force push the latest version, you need to wait for new version to be deployed on all regions.

Hi, @prafullakokadwar123, the tasks which own akvelon-build-task team are fixed(e.g. Powershell) and will be rolled out soon. Pinging @v-mohithgc as a task owner of a bunch of the tasks