How to patch MCR azure functions Java21 build image - 4-java21-build have remote code execution vulnerability

Question

How to patch MCR azure functions Java21 build image - 4-java21-build have remote code execution vulnerability

We are working to upgrade java 17 to Java 21 - but CVE-2021-26701 is blocking our build. This seems to be using few busted libraries,

Answer 1

Hello @Kalyan Guntupalli

To patch the MCR Azure Functions Java21 build image, you can follow the steps below:

1. Identify the specific version of the MCR Azure Functions Java21 build image that you are using. You can find this information in your Dockerfile or in your deployment configuration.
2. Check if there is a patch available for the specific version of the image that you are using. You can check the Azure Policy definitions for Function Apps that use Java to see if there is a policy that requires the use of the latest Java version. If there is, you can update your deployment configuration to use the latest Java version.
3. If there is no policy available for the specific version of the image that you are using, you can manually update the image to use the latest Java version. You can do this by updating your Dockerfile to use the latest Java version and rebuilding the image. Regarding the CVE-2021-26701 vulnerability, you should check if there is a patch available for the specific libraries that are affected. If there is, you can update your dependencies to use the patched version of the libraries. If there is no patch available, you should consider using an alternative library that is not affected by the vulnerability.

I hope this helps

---

I hope that this response has addressed your query and helped you overcome your challenges. If so, please mark this response as Answered. This will not only acknowledge our efforts, but also assist other community members who may be looking for similar solutions.