fix: [NPM] Update Ubuntu Base Image to 24.04

[rayaisaiah]

Reason for Change:
Bumps the NPM Ubuntu base image version from 20.04 to 24.04 as 20.04 is EOL and no longer supported (https://ubuntu.com/blog/ubuntu-20-04-lts-end-of-life-standard-support-is-coming-to-an-end-heres-how-to-prepare).

Manually updates the Ubuntu packages libsystemd0 and libudev1 to 255.4-1ubuntu8.8 or else CVE-2025-4598 is present in the image (Will revert later when base image updates packages to resolve the vulnerability):

acnpublic.azurecr.io/azure-npm:v1.6.26Test (ubuntu 24.04) ========================================================= Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0) ┌─────────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────┤ │ libsystemd0 │ CVE-2025-4598 │ MEDIUM │ fixed │ 255.4-1ubuntu8.6 │ 255.4-1ubuntu8.8 │ systemd-coredump: race condition that allows a local │ │ │ │ │ │ │ │ attacker to crash a SUID... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-4598 │ ├─────────────┤ │ │ │ │ │ │ │ libudev1 │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └─────────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────┘ 

Trivy scan of NPM linux with changes to dockerfile (with manual package updates):

acnpublic.azurecr.io/azure-npm:v1.6.26Test2 (ubuntu 24.04) ========================================================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) 

Tests Ran:

• Conformance
• Scale
• Cyclonus
• Cyclonus-Extended

Issue Fixed:

 mcr.microsoft.com/containernetworking/azure-npm:v1.5.48 (ubuntu 20.04) ====================================================================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0) ┌──────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬───────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├──────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼───────────────────────────────────────────────────────────┤ │ libc-bin │ CVE-2025-4802 │ MEDIUM │ fixed │ 2.31-0ubuntu9.17 │ 2.31-0ubuntu9.18 │ glibc: static setuid binary dlopen may incorrectly search │ │ │ │ │ │ │ │ LD_LIBRARY_PATH │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-4802 │ ├──────────┤ │ │ │ │ │ │ │ libc6 │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └──────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴───────────────────────────────────────────────────────────┘ usr/bin/azure-npm (gobinary) ============================ Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤ │ stdlib │ CVE-2025-22874 │ HIGH │ fixed │ v1.23.9 │ 1.23.10, 1.24.4 │ crypto/x509: Usage of ExtKeyUsageAny disables policy │ │ │ │ │ │ │ │ validation in crypto/x509 │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-22874 │ │ ├────────────────┼──────────┤ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-0913 │ MEDIUM │ │ │ │ Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows │ │ │ │ │ │ │ │ in os in syscall... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-0913 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2025-4673 │ │ │ │ │ Proxy-Authorization and Proxy-Authenticate headers persisted │ │ │ │ │ │ │ │ on cross- ... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-4673 │ └─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘ 

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:
Releasing from release/v1.6 branch instead of release/v1.5 due to Ubuntu base image update as well as v1.5 will be not be supported soon (due to k8s dependencies not matching with our offerings as it is tied to 1.27-1.29).

[rayaisaiah]

/azp run Azure Container Networking PR

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

/azp run NPM Scale Test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull Request Overview

Updates the Ubuntu base image from 20.04 to 24.04 and pins two packages to address CVE-2025-4598.

• Bump Docker base image to Ubuntu 24.04
• Pin libsystemd0 and libudev1 to 255.4-1ubuntu8.8 in the installation step

Comments suppressed due to low confidence (1)

npm/linux.Dockerfile:11

• Please add a comment above this RUN instruction to note that the version pinning of libsystemd0 and libudev1 is a temporary workaround for CVE-2025-4598 until the base image updates these packages.

RUN apt-get update && apt-get install -y libsystemd0=255.4-1ubuntu8.8 libudev1=255.4-1ubuntu8.8 iptables ipset ca-certificates && apt-get autoremove -y && apt-get clean 

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).