When are security patches applied to azure functions?

Question

When are security patches applied to azure functions?

Pedro Albuquerque Vaz 0

When are security patches applied to azure functions?
Is there a timeline or a specific date?

For example a Function running on Linux, on runtime ~4 using .NET Version ".NET 7 Isolated"

Documentation mentions that
"The Functions team is committed to publishing monthly updates for these base images. Regular updates include the latest minor version updates and security fixes for both the Functions runtime and languages."
https://learn.microsoft.com/en-us/azure/azure-functions/functions-app-settings

Since April 11 there is a new .NET release 7.0.5 that patches a Security vulnerability.
When I SSH into the function to check "dotnet --info" it outputs that Host is still running version 7.0.4 and .NET runtimes installed are also 7.0.4

When will that function get patched from .NET 7.0.4 to 7.0.5?

Thank you!

MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-05-11T15:56:28.9766667+00:00

Pedro Albuquerque Vaz Just a follow up to see if you still have questions on this. Feel free to add a comment and would be happy to answer any questions you may have.

1 answer

Your answer

MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-05-11T15:56:28.9766667+00:00

Pedro Albuquerque Vaz Just a follow up to see if you still have questions on this. Feel free to add a comment and would be happy to answer any questions you may have.

Answer 1

MuthuKumaranMurugaachari-MSFT 22,441 Moderator

Pedro Albuquerque Vaz Thanks for posting your question in Microsoft Q&A. As you referenced in doc: Custom images, we refresh azure-function base images monthly and especially for Linux Premium/Dedicated, we do twice a month and refer doc for more info about refresh images (not available for Linux Consumption). .NET 7.0.5 was already updated to the base image -donet-isolated7.0 (mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated7.0). We will roll out 4.19.2 with this update for Consumption and likely complete in 2 weeks (subject to change based on other factors).

I hope this helps with your question and let me know if you have any other questions.

Pedro Albuquerque Vaz 0 Reputation points

2023-05-16T15:02:30.75+00:00

Thank you for your answer.

Just SSHed into a Linux premium/dedicated function to check "dotnet --info" and it is still in version 7.0.4

given this function has LinuxFxVersion: DOTNET-ISOLATED|7.0
shouldn't it have been already patched to 7.0.5? When will it get patched?

Is there something that can be done by the user to expedite the patching without pinning it to a specific version, i.e., without changing the standard LinuxFxVersion: DOTNET-ISOLATED|7.0?

You mentioned that Linux Premium/Dedicated gets patched twice a month. Is there a page to follow this?
And also, what is the procedure for zero-day vulnerabilities?

Thank you very much for your time and patience.
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-05-16T15:12:28.9266667+00:00

Pedro Albuquerque Vaz Just to be clear, the patching above (twice a month) refers to the actual base images available in mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated7.0 for custom containers.

However, for runtime code, I will check the latest and update you.
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-05-16T19:33:51.0533333+00:00

Pedro Albuquerque Vaz Based on the discussion with the product team, ETA will be by the end of June (subject to change on other factors). Unfortunately, this cannot be expedited and follows regular updates. Let me know if you have any other questions.

Share via

When are security patches applied to azure functions?

1 answer

Your answer