What is CVE-2022-39327?

CVE-2022-39327 is a security advisory published by Microsoft Security Response Center (MSRC) with Critical severity. GitHub: CVE-2022-39327 Improper Control of Generation of Code ('Code Injection') in Azure CLI

Which CVE IDs does CVE-2022-39327 cover?

CVE-2022-39327 covers the following CVE IDs: CVE-2022-39327. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2022-39327?

CVE-2022-39327 affects 1 product, including: Azure CLI.

CVE-2022-39327Critical

GitHub: CVE-2022-39327 Improper Control of Generation of Code ('Code Injection') in Azure CLI

Vendor

Microsoft Security Response Center (MSRC)

Published

November 8, 2022

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2022-39327 →

📋 Description

Why is this GitHub CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in Azure cli, which is published on GitHub and for which GitHub is the CVE Naming Authority (CNA). It is being documented in the Security Update Guide to inform customers using the azure-cli that they need to apply the updated version. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

🎯 Affected products1

Azure CLI

✅ Remediation

KBImproper Control of Generation of Code ('Code Injection') in Azure CLI (Security Update) — fixed build 2.42.0

🔗 References (3)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-39327
patchhttps://github.com/Azure/azure-cli/releases/tag/azure-cli-2.42.0
referencehttps://github.com/Azure/azure-cli/security/advisories/GHSA-47xc-9rr2-q7p4#advisory-comment-75819