[Forwardport] [NPM] [CVE] Resolve CVE-2025-6020

[rayaisaiah]

Reason for Change:
Resolves CVE-2025-6020 present in the current v1.6.26 version. Forward port of #3763.

mcr.microsoft.com/containernetworking/azure-npm:v1.6.26 (ubuntu 24.04) ====================================================================== Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0) ┌────────────────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬───────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├────────────────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼───────────────────────────────────────────┤ │ libpam-modules │ CVE-2025-6020 │ MEDIUM │ fixed │ 1.5.3-5ubuntu5.1 │ 1.5.3-5ubuntu5.4 │ linux-pam: Linux-pam directory Traversal │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-6020 │ ├────────────────────┤ │ │ │ │ │ │ │ libpam-modules-bin │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ├────────────────────┤ │ │ │ │ │ │ │ libpam-runtime │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ├────────────────────┤ │ │ │ │ │ │ │ libpam0g │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └────────────────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴───────────────────────────────────────────┘ 

acnpublic.azurecr.io/azure-npm:v1.6.27Testing (ubuntu 24.04) ============================================================ Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) 

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[Copilot]

Pull Request Overview

This PR forward-ports the fix for CVE-2025-6020 by pinning the vulnerable libpam packages in the Linux Docker image.

• Adds specific libpam modules (libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g) at version 1.5.3-5ubuntu5.4 to the apt-get install line.
• Verifies the updated image has no remaining medium or higher security vulnerabilities.

Comments suppressed due to low confidence (1)

npm/linux.Dockerfile:10

• [nitpick] Add a comment above the new apt-get install line to note that the pinned libpam-* packages address CVE-2025-6020 for future maintainers.

COPY --from=builder /usr/local/bin/azure-npm /usr/bin/azure-npm 

[rayaisaiah]

/azp run Azure Container Networking PR

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

/azp run NPM Scale Test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

Passed conformance: https://msazure.visualstudio.com/One/_build/results?buildId=128867597&view=results