UBUNTU-CVE-2022-39327

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-39327
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-39327.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-39327
Upstream
Published
2022-10-25T17:15:00Z
Modified
2025-09-08T16:50:23Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the & or | symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.

References

Affected packages

Ubuntu:Pro:20.04:LTS / azure-cli

Package

Name
azure-cli
Purl
pkg:deb/ubuntu/azure-cli@2.0.81+ds-4ubuntu0.2?arch=source&distro=esm-apps/focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.81+ds-2
2.0.81+ds-3
2.0.81+ds-4
2.0.81+ds-4ubuntu0.2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.0.81+ds-4ubuntu0.2",
            "binary_name": "azure-cli"
        },
        {
            "binary_version": "2.0.81+ds-4ubuntu0.2",
            "binary_name": "python3-azure-cli"
        },
        {
            "binary_version": "2.0.81+ds-4ubuntu0.2",
            "binary_name": "python3-azure-cli-core"
        },
        {
            "binary_version": "2.0.81+ds-4ubuntu0.2",
            "binary_name": "python3-azure-cli-telemetry"
        },
        {
            "binary_version": "2.0.81+ds-4ubuntu0.2",
            "binary_name": "python3-azure-cli-testsdk"
        }
    ]
}