Azure Open Management Infrastructure Vulnerability（CVE-2022-29149）

Question

Azure Open Management Infrastructure Vulnerability（CVE-2022-29149）

kow1120 101

I have been informed by a vendor that there is a vulnerability "CVE-2022-29149" in Azure Open Management Infrastructure (OMI).

I have a question about this vulnerability.
The following website states that AzureVM is affected, but will MS take care of this vulnerability?

If the Fixed Version Number is not applicable as stated in this HP, do we need to update here?

srbhatta-MSFT 8,586 Reputation points Microsoft Employee

2022-07-18T05:29:21.277+00:00

Hello @kow1120 ,
Thanks for reporting the issue here on Microsoft QnA.
I am retagging this issue so that the appropriate Team for Azure Security can look into it. Thanks for your understanding!
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-07-18T08:46:22.13+00:00

@kow1120

Apologies for the delay response. As I understand you are looking for information on this vulnerability "CVE-2022-29149" related to your Azure VM.

Detailed information about the same has been provided here https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-29149 also What products are affected by this vulnerability are mentioned in the same article as well, you can refer to Fixed Version Number/Customer action required columns for more information.

Let me know if you have any further questions.
kow1120 101 Reputation points

2022-07-19T05:00:26.09+00:00

@Givary-MSFT

Thanks for the reply.

I would like to confirm the response to this case.
AzureVM automatically installs the Open Management Infrastructure (OMI) agent. So, is this not a customer issue and is there any plan to fix the problem on Microsoft's side?
srbhatta-MSFT 8,586 Reputation points Microsoft Employee

2022-07-19T10:08:17.193+00:00

Hello @kow1120 ,
Are you using Log Analytics Agent? Please note that the legacy Log Analytics agent will be deprecated by August 2024. Please be sure to migrate to Azure Monitor agent before August 2024 to continue ingesting data.
Regarding the CVE-2022-29149 vulnerability, Microsoft has published information on Fixed Version Number (that requires no action from customer side) as well as information on next steps required from customer side if fixed version number does not match. If fixed version number does not match, then as mentioned, you would need to manually update the OMS shell bundle as mentioned for Log Analytics Agent. If you are using some other product that in turn uses OMI, then please follow the 'customer required action' as mentioned depending on your product.
The information is available on the link shared by @Givary-MSFT . Please respond back if there's further information you need on this.
kow1120 101 Reputation points

2022-07-21T01:23:34.427+00:00

@srbhatta-MSFT

Thank you for your reply.
I am checking the affected AzureVMs, and if they are affected, do I need to do the 'customer required action' manually for all of them?
Sandeep V 0 Reputation points

2023-03-14T16:38:07.9566667+00:00

We created a VM with ubuntu 18.04 almost after the date of the above discussion but the image has the older version of OMI and our security scanning displayed it as a vulnerability. Had to fix it ourselves.