CVE-2022-29149: Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

What are some of the services affected by this vulnerability?

The following table lists some of the affected services, and the changes associated with the remedy for this vulnerability:

Affected Product

New Version Number

Customer action required

DSC

Patch for Version 3: 3.0.0.7 and Patch for Version 2: 2.71.1.33

No Customer Action required; these are auto updated for all customers.

SCOM

For 2016: 7.6.1108.0; for 2019: 10.19.1152.0; and for 2022: 10.22.1024.0

Customers need to update MPs 2016, 2019, and 2022.

OMS

1.14.13

There are 2 ways to install OMS Agent: Bundle or through VM Extension. Using a Bundle Link and for VM Extensions, through Azure Powershell CMDlets or Azure CLI.

ASC

1.14.13

Update via VM extension.

Container Monitoring Solution

Image tag: microsoft-oms-latest with full ID: sha256:6131e66cdf7bd07f9db3bbb17902ea8695a2f2bda0cf72ff16170aaf93b56f3b

See How to Upgrade OMS Docker for details on how to check your current image ID and to upgrade OMS-docker.

Sentinel

1.14.13

Update via VM extension.

Azure Stack Hub

1.14.13

Update via VM extension.

Azure HDInsight

HDInsight Version 4.0, 3.6; omsagent-1.14.13.0 and omi-1.6.9-1

A separate email was sent to impacted customers with instructions to update.

Azure Automation

Same as OMS Agent Version no change in automation version

Customers need to update OMS agent.

AUM

Same as OMS agent version

Customers need to update OMS agent.

Azure Diagnostics (LAD) (v3/v4)

LAD v3: 3.0.137 and LAD v4: 4.0.27

Update via VM Extension.