Please clarify which commit fixes CVE-2025-24049

[glaubitz]

Type of issue

Missing information

Reference command name

N/A

Feedback

Microsoft's security tracker reports that there was the CVE-2025-24049 [1] in Azure CLI up to excluding 2.69.0 but there is not a single clue what particular commit fixes this CVE.

Without knowing the exact commit, it is not possible for Linux distributions to address a particular CVE.

Please note that especially enterprise distributions can't always simply upgrade to the latest upstream version as such a process is more involved and complicated since it involves a lot of QA testing.

Can you therefore please disclose what particular commit fixed CVE-2025-24049?

Thanks!

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24049

Page URL

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24049

Content source URL

No response

Author

No response

Document Id

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

This issue is related to security. Please pay attention.

Powered by issue-sentinel

[AllyW]

@glaubitz Please check #30703 for resolving of CVE-2025-24049

[glaubitz]

@glaubitz Please check #30703 for resolving of CVE-2025-24049

Oh wow, I would have never guessed from the commit message that this particular change fixes a CVE.

It should definitely be documented to help distributions address this CVE.

[glaubitz]

This has been resolved for me now. I cherry-picked the patch from #30703.