How to install Python (Pip) Security Update for torch and Ubuntu Security Patch for VM in Azure machine learning studio?

Question

I have deployed two models and two endpoints on Azure Machine Learning studios. There are requests to install Python (Pip) Security Update for torch (GHSA-5pcm-hx3q-hm94) and Ubuntu Security patch for GLib Vulnerability (USN-7114-1) etc. patches. I could not find the Compute for my containers. I wonder how to install those patches or Azure machine learning team will manage those infra and install those patches? If I can install those patches, from where I can find the corresponding‌ patches, thank you in advance for your incoming great help. The SKU for the two endpoints are Standard_D2a_v4. Will Azure machine learning team patch those AML infra? or customers who are using AML can patch those infra? thanks.

Answer 1

Hello Helenhwl,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to install Python (Pip) Security Update for torch and Ubuntu Security Patch for VM in Azure machine learning studio.

• Azure Machine Learning manages the host OS virtual machine (VM) images for compute instances, compute clusters, and Data Science Virtual Machines. These images are updated monthly with the latest patches from the original OS publisher (Canonical for Ubuntu images) and any necessary system package updates.
• Base Docker images maintained by Azure Machine Learning receive frequent security patches to address newly discovered vulnerabilities. Updates for supported images are released every two weeks.
• Azure Machine Learning applies hotfixes within 72 hours for compute clusters and within a week for compute instances if vulnerabilities surface.
• Given that your endpoints use the Standard_D2a_v4 SKU, these updates and patches are managed by Azure Machine Learning. You don't need to manually install these patches yourself.
• If you have specific environments or custom containers, you might need to manage those separately. For custom environments, you can use a private package repository to ensure your packages are up-to-date.

For all the information above, you can read more right in the link below:

https://learn.microsoft.com/en-us/azure/machine-learning/concept-vulnerability-management?view=azureml-api-2

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.