[Forwardport] [NPM] [CVE] Resolve CVE-2025-6020

[rayaisaiah]

Reason for Change:
Resolves CVE-2025-6020 present in the current v1.6.26 version. Forward port of #3763.

mcr.microsoft.com/containernetworking/azure-npm:v1.6.26 (ubuntu 24.04)
======================================================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌────────────────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬───────────────────────────────────────────┐
│      Library       │ Vulnerability │ Severity │ Status │ Installed Version │  Fixed Version   │                   Title                   │
├────────────────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼───────────────────────────────────────────┤
│ libpam-modules     │ CVE-2025-6020 │ MEDIUM   │ fixed  │ 1.5.3-5ubuntu5.1  │ 1.5.3-5ubuntu5.4 │ linux-pam: Linux-pam directory Traversal  │
│                    │               │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-6020 │
├────────────────────┤               │          │        │                   │                  │                                           │
│ libpam-modules-bin │               │          │        │                   │                  │                                           │
│                    │               │          │        │                   │                  │                                           │
├────────────────────┤               │          │        │                   │                  │                                           │
│ libpam-runtime     │               │          │        │                   │                  │                                           │
│                    │               │          │        │                   │                  │                                           │
├────────────────────┤               │          │        │                   │                  │                                           │
│ libpam0g           │               │          │        │                   │                  │                                           │
│                    │               │          │        │                   │                  │                                           │
└────────────────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴───────────────────────────────────────────┘

acnpublic.azurecr.io/azure-npm:v1.6.27Testing (ubuntu 24.04)
============================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[Copilot]

Pull Request Overview

This PR forward-ports the fix for CVE-2025-6020 by pinning the vulnerable libpam packages in the Linux Docker image.

• Adds specific libpam modules (libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g) at version 1.5.3-5ubuntu5.4 to the apt-get install line.
• Verifies the updated image has no remaining medium or higher security vulnerabilities.

Comments suppressed due to low confidence (1)

npm/linux.Dockerfile:10

• [nitpick] Add a comment above the new apt-get install line to note that the pinned libpam-* packages address CVE-2025-6020 for future maintainers.

COPY --from=builder /usr/local/bin/azure-npm /usr/bin/azure-npm

[rayaisaiah]

/azp run Azure Container Networking PR

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

/azp run NPM Scale Test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

Passed conformance: https://msazure.visualstudio.com/One/_build/results?buildId=128867597&view=results