Bugzilla – Bug 1202088
VUL-0: CVE-2022-30187: python-azure-storage-blob: Information Disclosure Vulnerability
Last modified: 2025-05-04 09:31:25 UTC
CVE-2022-30187 Azure Storage Library Information Disclosure Vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-30187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30187 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30187 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30187
tracking as affected - SUSE:SLE-12-SP1:Update/python-azure-storage-blob - SUSE:SLE-15:Update/python-azure-storage-blob - SUSE:SLE-15-SP1:Update/python-azure-storage-blob
Would be nice if we could figure out which commit fixed the issue as updating individual SDK components can always have side effects.
Also requires storage-queue 12.4
But this is not possible for SLE 12, we cannot do a wholesale update in SLE 12 because Python 2.7 support has been dropped upstream. A wholesale update would only be possible in SLE 12 if we drop the Python 2.7 builds, but since the packages cannot be removed we'd still be shipping packages with a known vulnerability that cannot be updated. We have to find a path that allows us to address the issue in the Python 2.7 build.
(In reply to Robert Schweikert from comment #12) > But this is not possible for SLE 12, we cannot do a wholesale update in SLE > 12 because Python 2.7 support has been dropped upstream. > > A wholesale update would only be possible in SLE 12 if we drop the Python > 2.7 builds, but since the packages cannot be removed we'd still be shipping > packages with a known vulnerability that cannot be updated. We have to find > a path that allows us to address the issue in the Python 2.7 build. I agree. However, I'm not sure how to backport the change which is rather big and requires a newer version of python-azure-core.
so what about SLE15 and SLE15-SP1? Would fixing it there be possible ?
Is this new encryption support going to be required to be provided for SLE12?
(In reply to Robert Frohl from comment #14) > so what about SLE15 and SLE15-SP1? Would fixing it there be possible ? Any update about this question please? We have one related L3 incident.
(In reply to Lidong Zhong from comment #16) > (In reply to Robert Frohl from comment #14) > > so what about SLE15 and SLE15-SP1? Would fixing it there be possible ? > > Any update about this question please? We have one related L3 incident. Fixing this involves updating the python-azure-storage-blob version to the latest version. This is unfortunately not trivial as the update introduces a dependency on the python-typing_extensions package which requires a plethora if other package updates. I was hoping for a backport of the fix from Microsoft but since this did not happen, I will try to patch the python-typing_extensions dependency out to avoid pulling in so many additional package updates.
As mentioned in comment 23, I have a customer associated with bug 1203582 that is asking for a fix or some sort of guidance on what they should be doing to address this issue.
(In reply to Jake Norris from comment #24) > As mentioned in comment 23, I have a customer associated with bug 1203582 > that is asking for a fix or some sort of guidance on what they should be > doing to address this issue. I can prepare a repository with a preliminary set of updated packages tomorrow which fixes this issue if that would be OK?
(In reply to John Paul Adrian Glaubitz from comment #25) > I can prepare a repository with a preliminary set of updated packages > tomorrow which fixes this issue if that would be OK? It's better to let me prepare the packages based on your patches. So we can track the PTFs we delivered to each customer.
(In reply to Lidong Zhong from comment #26) > (In reply to John Paul Adrian Glaubitz from comment #25) > > I can prepare a repository with a preliminary set of updated packages > > tomorrow which fixes this issue if that would be OK? > > It's better to let me prepare the packages based on your patches. So we can > track the PTFs we delivered to each customer. The problem is that the CVE is not fixed by a few patches as the number of changes are too big. The fix involves updating at least two packages: python-azure-storage-blob and python-azure-core.
(In reply to John Paul Adrian Glaubitz from comment #27) > The problem is that the CVE is not fixed by a few patches as the number of > changes are too big. > > The fix involves updating at least two packages: python-azure-storage-blob > and python-azure-core. OK. Then I think I can prepare the PTF based on your IBS project. Please let me know what's your IBS project when it's done.
(In reply to Lidong Zhong from comment #28) > (In reply to John Paul Adrian Glaubitz from comment #27) > > The problem is that the CVE is not fixed by a few patches as the number of > > changes are too big. > > > > The fix involves updating at least two packages: python-azure-storage-blob > > and python-azure-core. > > OK. Then I think I can prepare the PTF based on your IBS project. Please let > me know what's your IBS project when it's done. Here you go: > https://build.suse.de/project/show/home:glaubitz:staging41:SUSE-SLE-15-SP1:Update Basically, this updates python-azure-storage-blob to 12.13.1 (the CVE fix is part of 12.13.0). Updating python-azure-storage-blob to 12.13.x requires python-azure-core to be updated to 1.23.1 hence this package is included in the update. Both packages were cherry-picked from openSUSE Factory, however python-azure-core was modified to allow an older version of python-typing_extensions (3.10.0.0 instead of 4.0.1). The compatibility with the older version of python-typing_extensions was verified according a small type check test provided by upstream [1]. > [1] https://github.com/Azure/azure-sdk-for-python/pull/22891#issuecomment-1283068774
Thanks for the work. PTF based on this project has been provided to customer.
SUSE-SU-2023:4609-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1202088 CVE References: CVE-2022-30187 Sources used: Public Cloud Module 15-SP2 (src): python-azure-storage-queue-12.4.0-150100.3.7.1 Public Cloud Module 15-SP1 (src): python-azure-storage-queue-12.4.0-150100.3.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:2897-1: An update that solves one vulnerability, contains two features and has one security fix can now be installed. Category: security (critical) Bug References: 1199282, 1202088 CVE References: CVE-2022-30187 Jira References: PM-3243, SLE-24629 Sources used: openSUSE Leap 15.4 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1 openSUSE Leap 15.5 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1 Public Cloud Module 15-SP1 (src): python-azure-core-1.23.1-150100.3.13.1, python-typing_extensions-3.10.0.0-150100.3.5.1, python-azure-storage-blob-12.13.1-150100.3.10.1 Public Cloud Module 15-SP2 (src): python-azure-core-1.23.1-150100.3.13.1, python-typing_extensions-3.10.0.0-150100.3.5.1, python-azure-storage-blob-12.13.1-150100.3.10.1 Public Cloud Module 15-SP3 (src): python-azure-core-1.23.1-150100.3.13.1, python-typing_extensions-3.10.0.0-150100.3.5.1, python-azure-storage-blob-12.13.1-150100.3.10.1 Public Cloud Module 15-SP4 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1 Public Cloud Module 15-SP5 (src): python-azure-core-1.23.1-150100.3.13.1, python-azure-storage-blob-12.13.1-150100.3.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1670-1: An update that solves one vulnerability can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-su-20241670-1 Category: security (moderate) Bug References: 1202088 CVE References: CVE-2022-30187 Maintenance Incident: [SUSE:Maintenance:32136](https://smelt.suse.de/incident/32136/) Sources used: Public Cloud Module 12 (src): python-azure-storage-blob-12.13.1-2.10.8, python-typing_extensions-3.10.0.0-2.6.1, python-azure-storage-queue-12.4.0-2.10.8, python-azure-core-1.23.1-2.12.8 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.