How the vulnerabilities are handled in Azure event Hub.

Question

Would like to know how the vulnerabilities and patches are handled in Azure event hubs. Like to know if there is any versioning similar to Azure Kubernetes services. For example, when there was a critical vulnerability (CVE-2024-21626) on AKS the fix was done by upgrading the AKS to a higher version.
How the fixes or patches will be rolled out for Azure Event Hubs.

Answer 1

@John Mathew, Subin (Allianz Technology) - Thanks for the question and using MS Q&A platform.

Azure Event Hubs is a managed, real-time data ingestion service that is simple, secure, and scalable. Microsoft manages security vulnerabilities and security updates (also referred to as patches) for Azure Event Hubs clusters.

Microsoft identifies and patches vulnerabilities and missing security updates for the following components:

• Azure Event Hubs Container Images
• Operating System (OS) images for the virtual machines (VMs) that run the Azure Event Hubs service

Azure Event Hubs Container Images are owned and maintained by the Azure Container Upstream team. The team takes responsibility for building the open-source packages that are deployed on Azure Event Hubs. With that responsibility, it includes having complete ownership of the build, scan, sign, validate, and hotfix process and control over the binaries in container images. By having responsibility for building the open-source packages deployed on Azure Event Hubs, it enables Microsoft to both establish a software supply chain over the binary and patch the software as needed.

For the OS images for the VMs that run the Azure Event Hubs service, Microsoft manages OS patching on two levels, the physical servers and the guest VMs that run the Azure Event Hubs resources. Both are updated monthly, which aligns to the monthly Patch Tuesday schedule. These updates are applied automatically, in a way that guarantees the high-availability SLA of Azure services.

When severe vulnerabilities require immediate patching, such as zero-day vulnerabilities, the high-priority updates are handled on a case-by-case basis. Microsoft provides critical security announcements in Azure by visiting the Azure Security Blog: Azure security baseline for Event Hubs

Regarding versioning, Azure Event Hubs does not have a versioning system similar to Azure Kubernetes Service. However, Microsoft ensures that the Azure Event Hubs service is always up-to-date with the latest security patches and updates.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.