fix: [NPM] [CVEs] Update NPM Linux Dockerfile to Fix Ubuntu Vulnerabilities

[rayaisaiah]

Reason for Change:
Updated NPM Linux dockerfile to manually run apt-get install to get latest versions of Ubuntu packages (libc-bin, libc6, and libtasn1-6) to resolve the following Ubuntu CVEs in NPM's base image.

Once the base image is updated to fixes we can remove this manually installation.

libc-bin CVE-2025-0395
libc6 CVE-2025-0395
libtasn1-6 CVE-2024-12133

Trivy scan of NPM on current v1.5 release:

mcr.microsoft.com/containernetworking/azure-npm:v1.5.42 (ubuntu 20.04)
======================================================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────┬───────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │   Fixed Version   │                           Title                           │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────────┼───────────────────────────────────────────────────────────┤
│ libc-bin   │ CVE-2025-0395  │ MEDIUM   │ fixed  │ 2.31-0ubuntu9.16  │ 2.31-0ubuntu9.17  │ glibc: buffer overflow in the GNU C Library's assert()    │
│            │                │          │        │                   │                   │ https://avd.aquasec.com/nvd/cve-2025-0395                 │
├────────────┤                │          │        │                   │                   │                                                           │
│ libc6      │                │          │        │                   │                   │                                                           │
│            │                │          │        │                   │                   │                                                           │
├────────────┼────────────────┤          │        ├───────────────────┼───────────────────┼───────────────────────────────────────────────────────────┤
│ libtasn1-6 │ CVE-2024-12133 │          │        │ 4.16.0-2          │ 4.16.0-2ubuntu0.1 │ libtasn1: Inefficient DER Decoding in libtasn1 Leading to │
│            │                │          │        │                   │                   │ Potential Remote DoS                                      │
│            │                │          │        │                   │                   │ https://avd.aquasec.com/nvd/cve-2024-12133                │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────────┴───────────────────────────────────────────────────────────┘

Trivy scan of NPM after dockerfile update:

acnpublic.azurecr.io/azure-npm:CVEFix (ubuntu 20.04)
===========================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[Copilot]

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

[rayaisaiah]

/azp run Azure Container Networking PR

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

/azp run NPM Scale Test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rbtr]

Running a package upgrade in the build is generally a bad idea - you will get something different every time. And if you do a global apt upgrade you will get a lot of different things every time.
If there are packages that need to be updated, you can apt install xxx-v1.2.3 to get specific (ie repeatable) versions of them.

[rayaisaiah]

Running an package upgrade in the build is generally a bad idea - you will get something different every time. And if you're a global apt upgrade you will get a lot of different things every time. If there are specific packages that need to be update, you can apt install xxx-v1.2.3 to get specific (ie repeatable) versions of them.

I see that makes sense. We needed updates to libc-bin, libc6, and libtasn1-6 packages specifically so I can make that change

RUN apt-get update && apt-get install -y libc-bin=2.31-0ubuntu9.17 libc6=2.31-0ubuntu9.17 libtasn1-6=4.16.0-2ubuntu0.1 iptables ipset ca-certificates && apt-get autoremove -y && apt-get clean

[rayaisaiah]

/azp run Azure Container Networking PR

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

/azp run NPM Scale Test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).