MSRC-CVE-2024-21421 — Azure SDK Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What actions do customers need to take to protect themselves from this vulnerability?
Customers with deployments created prior to Oct 19. 2023 must manually upgrade azure-core to Azure Core Build 1.29.5 or higher to be protected. For information reference the following: https://azure.github.io/azure-sdk/releases/latest/index.html. Customers with deployments created after October 19, 2023 recieved the fix automatically and no action is needed.

Security updates
1.29.5 — https://learn.microsoft.com/en-us/dotnet/api/overview/azure/core-readme?view=azure-dotnet

Vulnerabilities 1

High 7.5

CVE-2024-21421

Azure SDK Spoofing Vulnerability

Azure SDK Spoofing Vulnerability

Microsoft Azure SDK

Mar 12, 2024

Revision history

2024-03-12 #1
Information published.

References

CVE-2024-21421 Azure SDK Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21421
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss