Msrc Azl3 Kata-Containers-Cc 3.15.0.Aks0-5 On Azure Linux 3.0 vulnerabilities

CVE-2026-21895 [LOW] CWE-703 rsa crate has potential panic on a prime being equal to 1 rsa crate has potential panic on a prime being equal to 1 Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes

CVE-2025-67897 [MEDIUM] CWE-195 In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted mes In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet. Mariner: Mariner mitre

CVE-2025-62518 [HIGH] CWE-843 astral-tokio-tar Vulnerable to PAX Header Desynchronization astral-tokio-tar Vulnerable to PAX Header Desynchronization FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with

CVE-2025-58354 [MEDIUM] CWE-754 Kata Containers coco-tdx malicious host can circumvent initdata verification Kata Containers coco-tdx malicious host can circumvent initdata verification FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versio

CVE-2025-59825 [MEDIUM] CWE-22 astral-tokio-tar has a path traversal in tar extraction astral-tokio-tar has a path traversal in tar extraction FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which

CVE-2025-53605 [MEDIUM] CWE-674 The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input. The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefor

CVE-2025-5791 [HIGH] CWE-266 Users: `root` appended to group listings Users: `root` appended to group listings FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsof

CVE-2025-4574 [MEDIUM] CWE-415 Crossbeam-channel: crossbeam-channel vulnerable to double free on drop Crossbeam-channel: crossbeam-channel vulnerable to double free on drop FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the ope