Az.LogicApp:1.5.0 has vulnerable system.text.encodings.web:4.6.0 with high CVSS score of 9.8

Description

I am using Twistlock to scan our container image and from couple of months we are seeing a CVE related to system.text.encodings.web:4.6.0 in Az.LogicApp:1.5.0. Using latest PowerShell Version: 7.4.0

Dockerfile steps

# Powershell
RUN wget -q "https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb" \
    && dpkg -i packages-microsoft-prod.deb \
    && rm packages-microsoft-prod.deb \
    && apt-get update \
    && apt-get install -y powershell

# Powershell Modules
RUN pwsh -Command 'Install-Module -Name SqlServer -Scope AllUsers -Force'
RUN pwsh -Command 'Install-Module -Name Az -Scope AllUsers -Force'  # Receiving vulnerability in this step/layer

Twistlock report with CVE details

{
    "id": "CVE-2021-26701",
    "status": "fixed in 5.0.1, 4.7.2, 4.5.1",
    "cvss": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "description": ".NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.",
    "severity": "critical",
    "packageName": "system.text.encodings.web",
    "packageVersion": "4.6.0",
    "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-26701",
    "riskFactors": [
        "Remote execution",
        "Attack complexity: low",
        "Attack vector: network",
        "Critical severity",
        "DoS - High",
        "Has fix"
    ],
    "impactedVersions": [
        "\u003c4.7.2",
        "\u003e=4.6.0"
    ],
    "publishedDate": "2021-02-25T00:00:00Z",
    "discoveredDate": "2023-11-28T03:18:42Z",
    "graceDays": -256,
    "fixDate": "2023-02-15T10:43:47Z",
    "layerTime": "1970-01-01T00:00:00Z",
    "packagePath": "/usr/local/share/powershell/Modules/Az.LogicApp/1.5.0/Microsoft.Azure.PowerShell.Cmdlets.LogicApp.deps.json"
}

Content related to system.text.encodings.web in /usr/local/share/powershell/Modules/Az.LogicApp/1.5.0/Microsoft.Azure.PowerShell.Cmdlets.LogicApp.deps.json

"System.Text.Encoding/4.3.0": {
      "type": "package",
      "serviceable": true,
      "sha512": "sha512-BiIg+KWaSDOITze6jGQynxg64naAPtqGHBwDrLaCtixsa5bKiR8dpPOHA7ge3C0JJQizJE+sfkz1wV+BAKAYZw==",
      "path": "system.text.encoding/4.3.0",
      "hashPath": "system.text.encoding.4.3.0.nupkg.sha512"
    },
"System.Text.Encoding.Extensions/4.3.0": {
      "type": "package",
      "serviceable": true,
      "sha512": "sha512-YVMK0Bt/A43RmwizJoZ22ei2nmrhobgeiYwFzC4YAN+nue8RF6djXDMog0UCn+brerQoYVyaS+ghy9P/MUVcmw==",
      "path": "system.text.encoding.extensions/4.3.0",
      "hashPath": "system.text.encoding.extensions.4.3.0.nupkg.sha512"
    },
"System.Text.Encodings.Web/4.6.0": {
      "type": "package",
      "serviceable": true,
      "sha512": "sha512-BXgFO8Yi7ao7hVA/nklD0Hre1Bbce048ZqryGZVFifGNPuh+2jqF1i/jLJLMfFGZIzUOw+nCIeH24SQhghDSPw==",
      "path": "system.text.encodings.web/4.6.0",
      "hashPath": "system.text.encodings.web.4.6.0.nupkg.sha512"
    }

Issue script & Debug output

NA

Environment data

PS> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.4.0
PSEdition                      Core
GitCommitId                    7.4.0
OS                             Ubuntu 22.04.3 LTS
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

PS> Get-Module -ListAvailable

    Directory: /usr/local/share/powershell/Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Script     11.0.0                Az                                  Core,Desk 
Script     2.13.2                Az.Accounts                         Core,Desk {Disable-AzDataCollection, Disable-AzContextAutosave, Enable-AzDataCollection, Enable-AzContextAutosave…}
Script     2.0.0                 Az.Advisor                          Core,Desk {Disable-AzAdvisorRecommendation, Enable-AzAdvisorRecommendation, Get-AzAdvisorConfiguration, Get-AzAdvi…
Script     6.0.0                 Az.Aks                              Core,Desk {Get-AzAksCluster, New-AzAksCluster, Remove-AzAksCluster, Import-AzAksCredential…}
Script     1.1.4                 Az.AnalysisServices                 Core,Desk {Resume-AzAnalysisServicesServer, Suspend-AzAnalysisServicesServer, Get-AzAnalysisServicesServer, Remove…
Script     4.0.2                 Az.ApiManagement                    Core,Desk {Add-AzApiManagementApiToGateway, Add-AzApiManagementApiToProduct, Add-AzApiManagementProductToGroup, Ad…
Script     1.0.0                 Az.App                              Core,Desk {Disable-AzContainerAppRevision, Enable-AzContainerAppRevision, Get-AzContainerApp, Get-AzContainerAppAu…
Script     1.3.0                 Az.AppConfiguration                 Core,Desk {Get-AzAppConfigurationStore, Get-AzAppConfigurationStoreKey, New-AzAppConfigurationStore, New-AzAppConf…
Script     2.2.2                 Az.ApplicationInsights              Core,Desk {Get-AzApplicationInsights, Get-AzApplicationInsightsApiKey, Get-AzApplicationInsightsContinuousExport, …
Script     1.0.0                 Az.ArcResourceBridge                Core,Desk {Get-AzArcResourceBridge, Get-AzArcResourceBridgeApplianceCredential, Get-AzArcResourceBridgeCredential,…
Script     2.0.0                 Az.Attestation                      Core,Desk {Get-AzAttestationPolicy, Set-AzAttestationPolicy, Reset-AzAttestationPolicy, Get-AzAttestationPolicySig…
Script     1.0.0                 Az.Automanage                       Core,Desk {Get-AzAutomanageBestPractice, Get-AzAutomanageConfigProfile, Get-AzAutomanageConfigProfileAssignment, G…
Script     1.9.1                 Az.Automation                       Core,Desk {Set-AzAutomationPython3Package, New-AzAutomationPython3Package, Remove-AzAutomationPython3Package, Get-…
Script     3.5.0                 Az.Batch                            Core,Desk {Remove-AzBatchAccount, Get-AzBatchAccount, Get-AzBatchAccountKey, New-AzBatchAccount…}
Script     2.0.3                 Az.Billing                          Core,Desk {Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzEnrollmentAccount, Get-AzConsumptionBudget…}
Script     3.1.1                 Az.Cdn                              Core,Desk {Clear-AzCdnEndpointContent, Clear-AzFrontDoorCdnEndpointContent, Disable-AzCdnCustomDomainCustomHttps, …
Script     2.0.0                 Az.CloudService                     Core,Desk {Get-AzCloudService, Get-AzCloudServiceInstanceView, Get-AzCloudServiceNetworkInterface, Get-AzCloudServ…
Script     1.14.1                Az.CognitiveServices                Core,Desk {Get-AzCognitiveServicesAccount, Get-AzCognitiveServicesAccountKey, Get-AzCognitiveServicesAccountSku, G…
Script     7.0.0                 Az.Compute                          Core,Desk {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAvailabilitySet, Update-AzAvailabilitySet…}
Script     1.0.0                 Az.ConfidentialLedger               Core,Desk {Get-AzConfidentialLedger, New-AzConfidentialLedger, New-AzConfidentialLedgerAADBasedSecurityPrincipalOb…
Script     4.0.0                 Az.ContainerInstance                Core,Desk {Add-AzContainerInstanceOutput, Get-AzContainerGroup, Get-AzContainerInstanceCachedImage, Get-AzContaine…
Script     4.1.2                 Az.ContainerRegistry                Core,Desk {Connect-AzContainerRegistry, Get-AzContainerRegistryRepository, Remove-AzContainerRegistryRepository, U…
Script     1.13.0                Az.CosmosDB                         Core,Desk {Get-AzCosmosDBSqlContainer, Get-AzCosmosDBSqlContainerThroughput, Get-AzCosmosDBSqlDatabase, Get-AzCosm…
Script     1.1.0                 Az.DataBoxEdge                      Core,Desk {Get-AzDataBoxEdgeJob, Get-AzDataBoxEdgeDevice, Invoke-AzDataBoxEdgeDevice, New-AzDataBoxEdgeDevice…}
Script     1.7.1                 Az.Databricks                       Core,Desk {Get-AzDatabricksAccessConnector, Get-AzDatabricksOutboundNetworkDependenciesEndpoint, Get-AzDatabricksV…
Script     1.17.1                Az.DataFactory                      Core,Desk {Set-AzDataFactoryV2, Update-AzDataFactoryV2, Get-AzDataFactoryV2, Remove-AzDataFactoryV2…}
Script     1.0.3                 Az.DataLakeAnalytics                Core,Desk {Get-AzDataLakeAnalyticsDataSource, New-AzDataLakeAnalyticsCatalogCredential, Remove-AzDataLakeAnalytics…
Script     1.3.0                 Az.DataLakeStore                    Core,Desk {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeStoreFi…
Script     2.1.0                 Az.DataProtection                   Core,Desk {Backup-AzDataProtectionBackupInstanceAdhoc, Edit-AzDataProtectionPolicyRetentionRuleClientObject, Edit-…
Script     1.0.1                 Az.DataShare                        Core,Desk {New-AzDataShareAccount, Get-AzDataShareAccount, Remove-AzDataShareAccount, New-AzDataShare…}
Script     1.1.0                 Az.DeploymentManager                Core,Desk {Get-AzDeploymentManagerArtifactSource, New-AzDeploymentManagerArtifactSource, Set-AzDeploymentManagerAr…
Script     4.2.0                 Az.DesktopVirtualization            Core,Desk {Disconnect-AzWvdUserSession, Expand-AzWvdMsixImage, Get-AzWvdAppAttachPackage, Get-AzWvdApplication…}
Script     1.0.0                 Az.DevCenter                        Core,Desk {Get-AzDevCenterAdminAttachedNetwork, Get-AzDevCenterAdminCatalog, Get-AzDevCenterAdminDevBoxDefinition,…
Script     1.0.2                 Az.DevTestLabs                      Core,Desk {Get-AzDtlAllowedVMSizesPolicy, Get-AzDtlAutoShutdownPolicy, Get-AzDtlAutoStartPolicy, Get-AzDtlVMsPerLa…
Script     1.2.0                 Az.Dns                              Core,Desk {Get-AzDnsRecordSet, New-AzDnsRecordConfig, Remove-AzDnsRecordSet, Set-AzDnsRecordSet…}
Script     1.6.0                 Az.EventGrid                        Core,Desk {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGridTopic, New-AzEventGridTopicKey…}
Script     4.2.0                 Az.EventHub                         Core,Desk {New-AzEventHubAuthorizationRuleSASToken, Approve-AzEventHubPrivateEndpointConnection, Deny-AzEventHubPr…
Script     1.10.0                Az.FrontDoor                        Core,Desk {New-AzFrontDoor, Get-AzFrontDoor, Set-AzFrontDoor, Remove-AzFrontDoor…}
Script     4.0.7                 Az.Functions                        Core,Desk {Get-AzFunctionApp, Get-AzFunctionAppAvailableLocation, Get-AzFunctionAppPlan, Get-AzFunctionAppSetting…}
Script     6.0.2                 Az.HDInsight                        Core,Desk {Get-AzHDInsightJob, New-AzHDInsightSqoopJobDefinition, Wait-AzHDInsightJob, New-AzHDInsightStreamingMap…
Script     2.0.0                 Az.HealthcareApis                   Core,Desk {Get-AzHealthcareApisService, Get-AzHealthcareApisWorkspace, Get-AzHealthcareDicomService, Get-AzHealthc…
Script     2.7.5                 Az.IotHub                           Core,Desk {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-AzIotHubConnectionString, Get-AzIotHubJob…}
Script     5.0.0                 Az.KeyVault                         Core,Desk {Add-AzKeyVaultCertificate, Update-AzKeyVaultCertificate, Stop-AzKeyVaultCertificateOperation, Get-AzKey…
Script     2.3.0                 Az.Kusto                            Core,Desk {Add-AzKustoClusterLanguageExtension, Add-AzKustoDatabasePrincipal, Get-AzKustoAttachedDatabaseConfigura…
Script     1.0.0                 Az.LoadTesting                      Core,Desk {Get-AzLoad, New-AzLoad, Remove-AzLoad, Update-AzLoad}
Script     1.5.0                 Az.LogicApp                         Core,Desk {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccountAssembly, Get-AzIntegrationAccountBatchConfi…
Script     1.1.3                 Az.MachineLearning                  Core,Desk {Move-AzMlCommitmentAssociation, Get-AzMlCommitmentAssociation, Get-AzMlCommitmentPlanUsageHistory, Remo…
Script     1.0.0                 Az.MachineLearningServices          Core,Desk {Get-AzMLServiceQuota, Get-AzMLServiceUsage, Get-AzMLServiceVMSize, Get-AzMLWorkspace…}
Script     1.4.0                 Az.Maintenance                      Core,Desk {Get-AzApplyUpdate, Get-AzConfigurationAssignment, Get-AzMaintenanceConfiguration, Get-AzMaintenanceUpda…
Script     1.1.1                 Az.ManagedServiceIdentity           Core,Desk {Get-AzFederatedIdentityCredentials, Get-AzSystemAssignedIdentity, Get-AzUserAssignedIdentity, Get-AzUse…
Script     3.0.0                 Az.ManagedServices                  Core,Desk {Get-AzManagedServicesAssignment, Get-AzManagedServicesDefinition, Get-AzManagedServicesMarketplaceDefin…
Script     2.0.0                 Az.MarketplaceOrdering              Core,Desk {Get-AzMarketplaceTerms, Invoke-AzMarketplaceSignTerms, Set-AzMarketplaceTerms, Stop-AzMarketplaceTerms}
Script     1.1.2                 Az.Media                            Core,Desk {Sync-AzMediaServiceStorageKey, Set-AzMediaServiceKey, Get-AzMediaServiceKey, Get-AzMediaServiceNameAvai…
Script     2.2.0                 Az.Migrate                          Core,Desk {Get-AzMigrateDiscoveredServer, Get-AzMigrateJob, Get-AzMigrateProject, Get-AzMigrateReplicationFabric…}
Script     5.0.0                 Az.Monitor                          Core,Desk {Get-AzMetricDefinition, Get-AzMetric, Remove-AzLogProfile, Get-AzLogProfile…}
Script     1.1.1                 Az.MySql                            Core,Desk {Get-AzMySqlConfiguration, Get-AzMySqlConnectionString, Get-AzMySqlFirewallRule, Get-AzMySqlFlexibleServ…
Script     7.0.0                 Az.Network                          Core,Desk {Add-AzApplicationGatewayAuthenticationCertificate, Get-AzApplicationGatewayAuthenticationCertificate, N…
Script     1.0.0                 Az.NetworkCloud                     Core,Desk {Deploy-AzNetworkCloudCluster, Disable-AzNetworkCloudStorageApplianceRemoteVendorManagement, Enable-AzNe…
Script     1.1.2                 Az.NotificationHubs                 Core,Desk {Get-AzNotificationHub, Get-AzNotificationHubAuthorizationRule, Get-AzNotificationHubListKey, Get-AzNoti…
Script     3.2.0                 Az.OperationalInsights              Core,Desk {New-AzOperationalInsightsAzureActivityLogDataSource, New-AzOperationalInsightsCustomLogDataSource, Disa…
Script     1.6.4                 Az.PolicyInsights                   Core,Desk {Get-AzPolicyEvent, Get-AzPolicyState, Get-AzPolicyStateSummary, Get-AzPolicyRemediation…}
Script     1.1.0                 Az.PostgreSql                       Core,Desk {Get-AzPostgreSqlConfiguration, Get-AzPostgreSqlConnectionString, Get-AzPostgreSqlFirewallRule, Get-AzPo…
Script     2.0.0                 Az.PowerBIEmbedded                  Core,Desk {Resume-AzPowerBIEmbeddedCapacity, Suspend-AzPowerBIEmbeddedCapacity, Get-AzPowerBIEmbeddedCapacity, Rem…
Script     1.0.4                 Az.PrivateDns                       Core,Desk {Get-AzPrivateDnsZone, Remove-AzPrivateDnsZone, Set-AzPrivateDnsZone, New-AzPrivateDnsZone…}
Script     6.6.1                 Az.RecoveryServices                 Core,Desk {Get-AzRecoveryServicesBackupProperty, Get-AzRecoveryServicesVault, Get-AzRecoveryServicesVaultSettingsF…
Script     1.8.1                 Az.RedisCache                       Core,Desk {Remove-AzRedisCachePatchSchedule, New-AzRedisCacheScheduleEntry, Get-AzRedisCachePatchSchedule, New-AzR…
Script     1.2.0                 Az.RedisEnterpriseCache             Core,Desk {Export-AzRedisEnterpriseCache, Get-AzRedisEnterpriseCache, Get-AzRedisEnterpriseCacheDatabase, Get-AzRe…
Script     2.0.0                 Az.Relay                            Core,Desk {Get-AzRelayAuthorizationRule, Get-AzRelayHybridConnection, Get-AzRelayKey, Get-AzRelayNamespace…}
Script     1.2.0                 Az.ResourceMover                    Core,Desk {Add-AzResourceMoverMoveResource, Get-AzResourceMoverMoveCollection, Get-AzResourceMoverMoveResource, Ge…
Script     6.12.0                Az.Resources                        Core,Desk {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzRoleAssignment, New-AzRoleAssignment…}
Script     1.5.0                 Az.Security                         Core,Desk {Get-AzSecuritySolution, Get-AzSecuritySolutionsReferenceData, New-AzAlertsSuppressionRuleScope, Get-AzA…
Script     3.1.1                 Az.SecurityInsights                 Core,Desk {Get-AzSentinelAlertRule, Get-AzSentinelAlertRuleAction, Get-AzSentinelAlertRuleTemplate, Get-AzSentinel…
Script     3.0.0                 Az.ServiceBus                       Core,Desk {New-AzServiceBusAuthorizationRuleSASToken, Test-AzServiceBusNameAvailability, Approve-AzServiceBusPriva…
Script     3.3.0                 Az.ServiceFabric                    Core,Desk {Add-AzServiceFabricClientCertificate, Add-AzServiceFabricNode, Add-AzServiceFabricNodeType, Get-AzServi…
Script     2.0.0                 Az.SignalR                          Core,Desk {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSignalRKey…}
Script     4.11.0                Az.Sql                              Core,Desk {Invoke-AzSqlServerExternalGovernanceStatusRefresh, Get-AzSqlDatabaseTransparentDataEncryption, Set-AzSq…
Script     2.1.0                 Az.SqlVirtualMachine                Core,Desk {Get-AzAvailabilityGroupListener, Get-AzSqlVM, Get-AzSqlVMGroup, Invoke-AzRedeploySqlVM…}
Script     2.2.3                 Az.StackHCI                         Core,Desk {Add-AzStackHCIVMAttestation, Disable-AzStackHCIAttestation, Disable-AzStackHCIRemoteSupport, Enable-AzS…
Script     6.0.0                 Az.Storage                          Core,Desk {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStorageAccount, New-AzStorageAccountKey…}
Script     1.2.0                 Az.StorageMover                     Core,Desk {Get-AzStorageMover, Get-AzStorageMoverAgent, Get-AzStorageMoverEndpoint, Get-AzStorageMoverJobDefinitio…
Script     2.1.0                 Az.StorageSync                      Core,Desk {Invoke-AzStorageSyncCompatibilityCheck, New-AzStorageSyncService, Get-AzStorageSyncService, Set-AzStora…
Script     2.0.0                 Az.StreamAnalytics                  Core,Desk {Get-AzStreamAnalyticsCluster, Get-AzStreamAnalyticsClusterStreamingJob, Get-AzStreamAnalyticsDefaultFun…
Script     1.0.0                 Az.Support                          Core,Desk {Get-AzSupportService, Get-AzSupportProblemClassification, Get-AzSupportTicket, Get-AzSupportTicketCommu…
Script     3.0.4                 Az.Synapse                          Core,Desk {Get-AzSynapseSparkJob, Stop-AzSynapseSparkJob, Submit-AzSynapseSparkJob, Wait-AzSynapseSparkJob…}
Script     1.2.2                 Az.TrafficManager                   Core,Desk {Add-AzTrafficManagerCustomHeaderToEndpoint, Remove-AzTrafficManagerCustomHeaderFromEndpoint, Add-AzTraf…
Script     3.1.2                 Az.Websites                         Core,Desk {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServicePlan, Remove-AzAppServicePlan…}
Script     1.8.0                 azure.datafactory.tools             Desk      {Publish-AdfV2FromJson, Publish-AdfV2UsingArm, Get-AdfFromService, New-AdfPublishOption…}
Script     22.1.1                SqlServer                           Core,Desk {Add-RoleMember, Add-SqlAvailabilityDatabase, Add-SqlAvailabilityGroupListenerStaticIp, Add-SqlAzureAuth…

    Directory: /opt/microsoft/powershell/7/Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Manifest   1.2.5                 Microsoft.PowerShell.Archive        Desk      {Compress-Archive, Expand-Archive}
Manifest   7.0.0.0               Microsoft.PowerShell.Host           Core      {Start-Transcript, Stop-Transcript}
Manifest   7.0.0.0               Microsoft.PowerShell.Management     Core      {Add-Content, Clear-Content, Clear-ItemProperty, Join-Path…}
Binary     1.0.1                 Microsoft.PowerShell.PSResourceGet  Core,Desk {Find-PSResource, Get-InstalledPSResource, Get-PSResourceRepository, Get-PSScriptFileInfo…}
Manifest   7.0.0.0               Microsoft.PowerShell.Security       Core      {Get-Credential, Get-ExecutionPolicy, Set-ExecutionPolicy, ConvertFrom-SecureString…}
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        Core      {Export-Alias, Get-Alias, Import-Alias, New-Alias…}
Script     1.4.8.1               PackageManagement                   Desk      {Find-Package, Get-Package, Get-PackageProvider, Get-PackageSource…}
Script     2.2.5                 PowerShellGet                       Desk      {Find-Command, Find-DSCResource, Find-Module, Find-RoleCapability…}
Script     2.3.4                 PSReadLine                          Desk      {Get-PSReadLineKeyHandler, Set-PSReadLineKeyHandler, Remove-PSReadLineKeyHandler, Get-PSReadLineOption…}
Binary     2.0.3                 ThreadJob                           Desk      Start-ThreadJob

Error output

No response

Azure / azure-powershell

Az.LogicApp:1.5.0 has vulnerable system.text.encodings.web:4.6.0 with high CVSS score of 9.8 #23603

Description

Issue script & Debug output

Environment data

Module versions

Error output