Newly Discovered "By-Design" Flaw in Microsoft Azure Could Expose Storage Accounts to Hackers

A "by-design flaw" uncovered in Microsoft Azure could be exploited by attackers to gain access to storage accounts, move laterally in the environment, and even execute remote code. "It is possible to abuse and leverage Microsoft Storage Accounts by manipulating Azure Functions to steal...

Best practices regarding Azure Storage Keys, Azure Functions, and Azure Role Based Access

Summary Azure provides developers and security operations staff a wide array of configurable security options to meet organizational needs. Throughout the software development lifecycle, it is important for customers to understand the shared responsibility model, as well as be familiar with vario...

io.quarkus:quarkus-amazon-lambda-http (1.6.1.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.6.1.final) +73 more potentially affected by CVE-2023-0044 via io.quarkus:quarkus-vertx-http (1.6.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.6.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.6.1.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.4.final) +68 more potentially affected by CVE-2023-0044 via io.quarkus:quarkus-vertx-http (1.7.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.4.final -...

io.quarkus:quarkus-azure-functions-http (0.23.2), io.quarkus:quarkus-azure-functions-http-deployment (0.23.2) +49 more potentially affected by CVE-2023-0044 via io.quarkus:quarkus-vertx-http (0.23.2)

io.quarkus:quarkus-vertx-http MAVEN version 0.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.23.2 - io.quarkus:quarkus-azure-functions-http-deployment...

Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access

Four different Microsoft Azure services have been found vulnerable to server-side request forgery SSRF attacks that could be exploited to gain unauthorized access to cloud resources. The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API...

Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access

Four different Microsoft Azure services have been found vulnerable to server-side request forgery SSRF attacks that could be exploited to gain unauthorized access to cloud resources. The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API...

io.quarkus:quarkus-amazon-lambda-http (1.3.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.4.final) +53 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.3.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.3.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.9.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.0.cr1) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.9.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.1.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.1.0.cr1) +51 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.1.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.1.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.11.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.4.final) +174 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.11.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.11.4.final -...

io.quarkiverse.cxf:quarkus-cxf (0.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (0.1.1) +390 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.10.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 0.1.1 - io.quarkiverse.cxf:quarkus-cxf-deployment 0.1.1 -...

io.quarkus:quarkus-amazon-lambda-http (1.10.1.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.1.final) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.10.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.10.1.final -...

io.quarkus:quarkus-azure-functions-http (0.23.1), io.quarkus:quarkus-azure-functions-http-deployment (0.23.1) +38 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (0.23.1)

io.quarkus:quarkus-vertx-http MAVEN version 0.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.23.1 - io.quarkus:quarkus-azure-functions-http-deployment...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.1.final), io.quarkus:quarkus-azure-functions-http-deployment (1.9.1.final) +34 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.9.1.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.9.1.final -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.0.1.final), io.quarkus:quarkus-azure-functions-http-deployment (1.0.1.final) +27 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.0.1.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.0.1.final -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.1.final), io.quarkus:quarkus-azure-functions-http-deployment (1.10.1.final) +34 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.10.1.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.10.1.final -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.0.alpha2), io.quarkus:quarkus-azure-functions-http-deployment (1.3.0.alpha2) +30 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.3.0.alpha2)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.3.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.3.0.alpha2 -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.5.final), io.quarkus:quarkus-azure-functions-http-deployment (1.11.5.final) +51 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.11.5.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.11.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.11.5.final -...

Stronger Cloud Security in Azure Functions Using Custom Cloud Container

In this entry, we discuss how developers can use custom cloud container image and the distroless approach to minimize security gaps in Azure Functions...