{"DocumentNotes":[{"Audience":"Public","Ordinal":"0","Title":"Release Notes","Type":1,"Value":"
This release consists of security updates for the following products, features and roles.
\nPlease note the following information regarding the security updates:
\n| Date | \nBlog Post | \n
|---|---|
| January 11, 2022 | \nComing Soon: New Security Update Guide Notification System | \n
| February 9, 2021 | \nContinuing to Listen: Good News about the Security Update Guide API | \n
| January 13, 2021 | \nSecurity Update Guide Supports CVEs Assigned by Industry Partners | \n
| December 8, 2020 | \nSecurity Update Guide: Let’s keep the conversation going | \n
| November 9, 2020 | \nVulnerability Descriptions in the New Version of the Security Update Guide | \n
The following CVEs have FAQs, Mitigations, or Workarounds. You can see these in more detail from the Vulnerabilities tab by selecting FAQs, Mitigations and Workarounds columns in the Edit Columns panel.
\nYou can see these in more detail from the Deployments tab by selecting Known Issues column in the Edit Columns panel.
\nFor more information about Windows Known Issues, please see Windows message center (links to currently-supported versions of Windows are in the left pane).
\n| KB Article | \nApplies To | \n
|---|---|
| 5010324 | \nMicrosoft Exchange Server 2013 | \n
| 5011487 | \nWindows 10, version 20H2, Windows Server, version 20H2, Windows 10, version 21H1, Windows 10, version 21H2 | \n
| 5011495 | \nWindows 10, version 1607, Windows Server 2016 | \n
| 5011497 | \nWindows Server 2022 | \n
| 5011503 | \nWindows 10, version 1809, Windows Server 2019 | \n
| 5011525 | \nWindows Server 2008 (Security-only update) | \n
| 5011527 | \nWindows Server 2012 (Security-only update) | \n
| 5011529 | \nWindows 7, Windows Server 2008 R2 (Security-only update) | \n
| 5011534 | \nWindows Server 2008 (Monthly Rollup) | \n
| 5011535 | \nWindows Server 2012 (Monthly Rollup) | \n
| 5011552 | \nWindows 7, Windows Server 2008 R2 (Monthly Rollup) | \n
| 5011560 | \nWindows 8.1, Windows Server 2012 R2 (Security-only update) | \n
| 5011564 | \nWindows 8.1, Windows Server 2012 R2 (Monthly Rollup) | \n
| 5012698 | \nMicrosoft Exchange Server 2016, 2019 | \n
Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"mitre","Type":8,"Value":"mitre"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"0","ProductStatuses":[{"ProductID":["16825-17084","16982-17084","19746-17084","19801-17086","19807-17084","16968-16820","16969-16820","16970-16820","16971-16820","16972-16820","16973-16820","16947-16820","16974-16820","16975-16820","16976-16820","16977-16823","16978-16823","16979-16823","16980-16823","16981-16823","16825-16817","16982-16817","19801-21692"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"2.5.12-4","ProductID":["16825-17084","16825-16817"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16825-17084","16825-16817"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["16982-17084","16977-16823","16982-16817"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16982-17084","16977-16823","16982-16817"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"38.0.72.2-1","ProductID":["19801-17086","19807-17084","19801-21692"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["19801-17086","19807-17084","19801-21692"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.8.0.332-2","ProductID":["16968-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16968-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"8.6.13-1","ProductID":["16969-16820","16978-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16969-16820","16978-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"2.7.18-13","ProductID":["16970-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16970-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.35.0-4","ProductID":["16971-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16971-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"24.2-2","ProductID":["16972-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16972-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"3.6-3","ProductID":["16973-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16973-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.66.0-4","ProductID":["16947-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16947-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"3.7.13-5","ProductID":["16974-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16974-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"10.3.36-1","ProductID":["16975-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16975-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.2.12-1","ProductID":["16976-16820","16981-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16976-16820","16981-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"7.93-1","ProductID":["16979-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16979-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.76.0-3","ProductID":["16980-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16980-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2026-02-18T15:06:05","Description":{"Value":"Information published.
\n"},"Number":"3.0"},{"Date":"2026-08-17T21:09:43","Description":{"Value":"Information published.
\n"},"Number":"5.0"},{"Date":"2022-03-31T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"},{"Date":"2022-09-17T00:00:00","Description":{"Value":"Added mariadb to CBL-Mariner 1.0\nAdded python3 to CBL-Mariner 1.0
\n"},"Number":"1.1"},{"Date":"2023-04-17T00:00:00","Description":{"Value":"Added tcl to CBL-Mariner 1.0
\n"},"Number":"1.2"},{"Date":"2023-04-18T00:00:00","Description":{"Value":"Added boost to CBL-Mariner 2.0
\n"},"Number":"1.3"},{"Date":"2023-04-19T00:00:00","Description":{"Value":"Added nmap to CBL-Mariner 2.0\nAdded tcl to CBL-Mariner 2.0
\n"},"Number":"1.4"},{"Date":"2024-06-30T07:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.5"},{"Date":"2024-07-13T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.6"},{"Date":"2024-08-29T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.7"},{"Date":"2024-08-30T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.8"},{"Date":"2024-08-31T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.9"},{"Date":"2024-09-01T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.0"},{"Date":"2024-09-02T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.1"},{"Date":"2024-09-03T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.2"},{"Date":"2024-09-05T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.3"},{"Date":"2024-09-06T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.4"},{"Date":"2024-09-07T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.5"},{"Date":"2024-09-08T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.6"},{"Date":"2024-09-11T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"2.7"},{"Date":"2025-03-14T00:00:00","Description":{"Value":"Added teckit to Azure Linux 3.0\nAdded cloud-hypervisor-cvm to Azure Linux 3.0\nAdded grpc to Azure Linux 3.0\nAdded cmake to Azure Linux 3.0\nAdded cloud-hypervisor-cvm to CBL-Mariner 2.0\nAdded rust to CBL-Mariner 2.0\nAdded qt5-qtbase to CBL-Mariner 2.0\nAdded boost to CBL-Mariner 2.0\nAdded nmap to CBL-Mariner 2.0\nAdded tcl to CBL-Mariner 2.0\nAdded zlib to CBL-Mariner 2.0\nAdded nmap to CBL-Mariner 1.0\nAdded boost to CBL-Mariner 1.0\nAdded erlang to CBL-Mariner 1.0\nAdded tcl to CBL-Mariner 1.0\nAdded zlib to CBL-Mariner 1.0\nAdded mariadb to CBL-Mariner 1.0\nAdded python3 to CBL-Mariner 1.0
\n"},"Number":"2.8"},{"Date":"2026-08-12T23:17:16","Description":{"Value":"Information published.
\n"},"Number":"4.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16825-17084"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16982-17084"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["19746-17084"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["19801-17086"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["19807-17084"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16968-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16969-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16970-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16971-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16972-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16973-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16947-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16974-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16975-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16976-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16977-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16978-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16979-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16980-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16981-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16825-16817"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16982-16817"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["19801-21692"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16825-17084"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16982-17084"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["19746-17084"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["19801-17086"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["19807-17084"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16968-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16969-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16970-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16971-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16972-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16973-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16947-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16974-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16975-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16976-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16977-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16978-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16979-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16980-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16981-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16825-16817"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16982-16817"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["19801-21692"],"Type":3}],"Title":{"Value":"zlib before 1.2.12 allows memory corruption when deflating (i.e. when compressing) if the input has many distant matches."}},{"Acknowledgments":[],"CVE":"CVE-2020-35501","CVSSScoreSets":[{"BaseScore":3.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18719-16820"],"TemporalScore":3.4,"Vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},{"BaseScore":3.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18752-16823"],"TemporalScore":3.4,"Vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}],"CWE":[{"ID":"CWE-863","Value":"Incorrect Authorization"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"1","ProductStatuses":[{"ProductID":["18719-16820","18752-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["18719-16820","18752-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18719-16820","18752-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-04-08T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"},{"Date":"2022-04-09T00:00:00","Description":{"Value":"Added kernel to CBL-Mariner 1.0
\n"},"Number":"1.1"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18719-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18752-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Low"},"ProductID":["18719-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Low"},"ProductID":["18752-16823"],"Type":3}],"Title":{"Value":"A flaw was found in the Linux kernels implementation of audit rules where a syscall can unexpectedly not be correctly not be logged by the audit subsystem"}},{"Acknowledgments":[],"CVE":"CVE-2021-20257","CVSSScoreSets":[{"BaseScore":6.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18887-16820"],"TemporalScore":6.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"},{"BaseScore":6.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18757-16823"],"TemporalScore":6.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}],"CWE":[{"ID":"CWE-835","Value":"Loop with Unreachable Exit Condition ('Infinite Loop')"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"2","ProductStatuses":[{"ProductID":["18887-16820","18757-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"4.2.0-39","ProductID":["18887-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18887-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"6.2.0-2","ProductID":["18757-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18757-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2023-03-10T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18887-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18757-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18887-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18757-16823"],"Type":3}],"Title":{"Value":"An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host resulting in a denial of service. The highest threat from this vulnerability is to system availability."}},{"Acknowledgments":[],"CVE":"CVE-2021-23192","CVSSScoreSets":[{"BaseScore":7.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["16864-17084"],"TemporalScore":7.5,"Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"CWE":[{"ID":"CWE-20","Value":"Improper Input Validation"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"3","ProductStatuses":[{"ProductID":["16864-17084"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"4.18.3-1","ProductID":["16864-17084"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["16864-17084"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2024-10-15T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["16864-17084"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["16864-17084"],"Type":3}],"Title":{"Value":"A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request and chose to fragment it an attacker could replace later fragments with their own data bypassing the signature requirements."}},{"Acknowledgments":[],"CVE":"CVE-2021-23214","CVSSScoreSets":[{"BaseScore":8.1,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18890-16820"],"TemporalScore":8.1,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"BaseScore":8.1,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18891-16823"],"TemporalScore":8.1,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"CWE":[{"ID":"CWE-89","Value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"4","ProductStatuses":[{"ProductID":["18890-16820","18891-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"12.7-2","ProductID":["18890-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18890-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"14.2-1","ProductID":["18891-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18891-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-16T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18890-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18891-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18890-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18891-16823"],"Type":3}],"Title":{"Value":"When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of SSL certificate verification and encryption."}},{"Acknowledgments":[],"CVE":"CVE-2021-23222","CVSSScoreSets":[{"BaseScore":5.9,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18890-16820"],"TemporalScore":5.9,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"BaseScore":5.9,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18891-16823"],"TemporalScore":5.9,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"CWE":[{"ID":"CWE-522","Value":"Insufficiently Protected Credentials"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"5","ProductStatuses":[{"ProductID":["18890-16820","18891-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"12.7-2","ProductID":["18890-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18890-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"14.2-1","ProductID":["18891-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18891-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-11T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18890-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18891-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18890-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18891-16823"],"Type":3}],"Title":{"Value":"A man-in-the-middle attacker can inject false responses to the client's first few queries despite the use of SSL certificate verification and encryption."}},{"Acknowledgments":[],"CVE":"CVE-2021-25220","CVSSScoreSets":[{"BaseScore":6.8,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18759-16820"],"TemporalScore":6.8,"Vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N"},{"BaseScore":6.8,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18760-16823"],"TemporalScore":6.8,"Vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N"}],"CWE":[{"ID":"CWE-444","Value":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"isc","Type":8,"Value":"isc"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"6","ProductStatuses":[{"ProductID":["18759-16820","18760-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"9.16.27-1","ProductID":["18759-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18759-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"9.16.29-1","ProductID":["18760-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18760-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-30T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18759-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18760-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18759-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18760-16823"],"Type":3}],"Title":{"Value":"DNS forwarders - cache poisoning vulnerability"}},{"Acknowledgments":[],"CVE":"CVE-2021-3602","CVSSScoreSets":[{"BaseScore":5.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["17367-16823"],"TemporalScore":5.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"BaseScore":5.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["19839-21692"],"TemporalScore":5.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"BaseScore":5.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["19839-17086"],"TemporalScore":5.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"CWE":[{"ID":"CWE-212","Value":"Improper Removal of Sensitive Information Before Storage or Transfer"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"7","ProductStatuses":[{"ProductID":["17367-16823","19839-21692","19839-17086"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.21.7-2","ProductID":["17367-16823","19839-21692","19839-17086"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["17367-16823","19839-21692","19839-17086"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2026-08-12T21:44:58","Description":{"Value":"Information published.
\n"},"Number":"2.0"},{"Date":"2024-04-15T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"},{"Date":"2026-02-18T02:21:51","Description":{"Value":"Information published.
\n"},"Number":"1.1"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["17367-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["19839-21692"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["19839-17086"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["17367-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["19839-21692"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["19839-17086"],"Type":3}],"Title":{"Value":"An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials)."}},{"Acknowledgments":[],"CVE":"CVE-2021-3609","CVSSScoreSets":[{"BaseScore":7.0,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18780-16820"],"TemporalScore":7.0,"Vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"CWE":[{"ID":"CWE-362","Value":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"8","ProductStatuses":[{"ProductID":["18780-16820"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["18780-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18780-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-11T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18780-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18780-16820"],"Type":3}],"Title":{"Value":".A flaw was found in the CAN BCM networking protocol in the Linux kernel where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root."}},{"Acknowledgments":[],"CVE":"CVE-2021-3618","CVSSScoreSets":[{"BaseScore":7.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18882-16820"],"TemporalScore":7.4,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"BaseScore":7.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18883-16820"],"TemporalScore":7.4,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"BaseScore":7.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18884-16823"],"TemporalScore":7.4,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"BaseScore":7.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18885-16823"],"TemporalScore":7.4,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"BaseScore":7.4,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18886-16823"],"TemporalScore":7.4,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"CWE":[{"ID":"CWE-295","Value":"Improper Certificate Validation"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"9","ProductStatuses":[{"ProductID":["18882-16820","18883-16820","18884-16823","18885-16823","18886-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"3.0.5-1","ProductID":["18882-16820","18885-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18882-16820","18885-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.20.1-3","ProductID":["18883-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18883-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"8.15.2-46","ProductID":["18884-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18884-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"1.20.2-2","ProductID":["18886-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18886-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-04-05T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18882-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18883-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18884-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18885-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18886-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18882-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18883-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18884-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18885-16823"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18886-16823"],"Type":3}],"Title":{"Value":"ALPACA is an application layer protocol content confusion attack exploiting TLS servers implementing different protocols but using compatible certificates such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer."}},{"Acknowledgments":[],"CVE":"CVE-2021-3620","CVSSScoreSets":[{"BaseScore":5.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18892-16820"],"TemporalScore":5.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"CWE":[{"ID":"CWE-209","Value":"Generation of Error Message Containing Sensitive Information"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"10","ProductStatuses":[{"ProductID":["18892-16820"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"2.9.27-1","ProductID":["18892-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18892-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-16T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18892-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18892-16820"],"Type":3}],"Title":{"Value":"A flaw was found in Ansible Engine's ansible-connection module where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality."}},{"Acknowledgments":[],"CVE":"CVE-2021-3631","CVSSScoreSets":[{"BaseScore":6.3,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18897-16820"],"TemporalScore":6.3,"Vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"CWE":[{"ID":"CWE-732","Value":"Incorrect Permission Assignment for Critical Resource"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"11","ProductStatuses":[{"ProductID":["18897-16820"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"6.1.0-5","ProductID":["18897-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18897-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-11T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18897-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18897-16820"],"Type":3}],"Title":{"Value":"A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity."}},{"Acknowledgments":[],"CVE":"CVE-2021-36368","CVSSScoreSets":[{"BaseScore":3.7,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18888-16820"],"TemporalScore":3.7,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"BaseScore":3.7,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["17826-16823"],"TemporalScore":3.7,"Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"CWE":[{"ID":"CWE-287","Value":"Improper Authentication"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"mitre","Type":8,"Value":"mitre"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"12","ProductStatuses":[{"ProductID":["18888-16820","17826-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["18888-16820","17826-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18888-16820","17826-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-20T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18888-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["17826-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Low"},"ProductID":["18888-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Low"},"ProductID":["17826-16823"],"Type":3}],"Title":{"Value":"An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose and an attacker has silently modified the server to support the None authentication option then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is \"this is not an authentication bypass since nothing is being bypassed."}},{"Acknowledgments":[],"CVE":"CVE-2021-3638","CVSSScoreSets":[{"BaseScore":6.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18887-16820"],"TemporalScore":6.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"},{"BaseScore":6.5,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18757-16823"],"TemporalScore":6.5,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}],"CWE":[{"ID":"CWE-787","Value":"Out-of-bounds Write"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"13","ProductStatuses":[{"ProductID":["18887-16820","18757-16823"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"4.2.0-39","ProductID":["18887-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18887-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"6.2.0-2","ProductID":["18757-16823"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18757-16823"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2023-03-10T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18887-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18757-16823"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18887-16820"],"Type":3},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18757-16823"],"Type":3}],"Title":{"Value":"An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host resulting in a denial of service."}},{"Acknowledgments":[],"CVE":"CVE-2021-3640","CVSSScoreSets":[{"BaseScore":7.0,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18768-16820"],"TemporalScore":7.0,"Vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"CWE":[{"ID":"CWE-362","Value":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"14","ProductStatuses":[{"ProductID":["18768-16820"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["18768-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18768-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-17T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18768-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18768-16820"],"Type":3}],"Title":{"Value":"A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system."}},{"Acknowledgments":[],"CVE":"CVE-2021-3656","CVSSScoreSets":[{"BaseScore":8.8,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18780-16820"],"TemporalScore":8.8,"Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}],"CWE":[{"ID":"CWE-862","Value":"Missing Authorization"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"15","ProductStatuses":[{"ProductID":["18780-16820"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["18780-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18780-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-11T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18780-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Important"},"ProductID":["18780-16820"],"Type":3}],"Title":{"Value":"A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the \"virt_ext\" field this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result the L2 guest would be allowed to read/write physical pages of the host resulting in a crash of the entire system leak of sensitive data or potential guest-to-host escape."}},{"Acknowledgments":[],"CVE":"CVE-2021-3660","CVSSScoreSets":[{"BaseScore":4.3,"EnvironmentalScore":0,"IsTemporalScoreFieldSpecified":false,"ProductID":["18895-16820"],"TemporalScore":4.3,"Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}],"CWE":[{"ID":"CWE-1021","Value":"Improper Restriction of Rendered UI Layers or Frames"}],"DiscoveryDate":"0001-01-01T00:00:00","DiscoveryDateSpecified":false,"Notes":[{"Ordinal":"0","Title":"Description","Type":2},{"Ordinal":"10","Title":"FAQ","Type":4,"Value":"Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
\nOne of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
\n"},{"Ordinal":"20","Title":"Mariner","Type":7,"Value":"Mariner"},{"Ordinal":"30","Title":"redhat","Type":8,"Value":"redhat"},{"Ordinal":"40","Title":"Customer Action Required","Type":6,"Value":"Yes"}],"Ordinal":"16","ProductStatuses":[{"ProductID":["18895-16820"],"Type":3}],"ReleaseDate":"0001-01-01T00:00:00","ReleaseDateSpecified":false,"Remediations":[{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"CBL-Mariner Releases"},"FixedBuild":"-","ProductID":["18895-16820"],"RestartRequired":{"Value":"No"},"SubType":"Security Update","Type":2,"URL":""},{"AffectedFiles":[],"Date":"0001-01-01T00:00:00","DateSpecified":false,"ProductID":["18895-16820"],"SubType":"CBL-Mariner Releases","Type":3,"URL":"https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"}],"RevisionHistory":[{"Date":"2022-03-15T00:00:00","Description":{"Value":"Information published.
\n"},"Number":"1.0"}],"Threats":[{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{},"ProductID":["18895-16820"],"Type":0},{"Date":"0001-01-01T00:00:00","DateSpecified":false,"Description":{"Value":"Moderate"},"ProductID":["18895-16820"],"Type":3}],"Title":{"Value":"Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website inside an