CVE-2024-48510 - Critical Severity Security Vulnerabilities in Azure Functions Node Docker Image - mcr.microsoft.com/azure-functions/node:4-node22

Question

Defender for cloud reporting CVE-2024-48510 - Critical Severity Security Vulnerability in mcr.microsoft.com/azure-functions/node:4-node22
DotNetZip v.1.16.0 and earlier versions are vulnerable to a Directory Traversal vulnerability.

Noticed same issue in nightly image mcr.microsoft.com/azure-functions/node:4-nightly-node22

Is there any fixed image available to use?

Answer 1

Hello @Sundaramoorthy, Manikandan,

Thank you for providing the necessary details. I have consulted with the Azure Functions engineering team and am sharing the following information. Team has investigated further and confirmed that they are working on Fix to mitigate this issue, and the fix will be rolled in the next releases of core tools.

Unfortunately, we don't have any exact ETA at this moment once the fix is rolled out will update the thread here.

Meanwhile as a workaround you can mitigate this issue by either editing the package.json to remove the Dev Dependency or running this command as part of the Docker File.
npm uninstall azure-functions-core-tools --save-dev

Hope this helps, let me know if you have any further questions on this.