fix CVE-2024-45337

[andyzhangx]

usr/local/bin/azcopy (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2024-45337 │ HIGH │ fixed │ v0.28.0 │ 0.31.0 │ Misuse of ServerConfig.PublicKeyCallback may cause │
│ │ │ │ │ │ │ authorization bypass in golang.org/x/crypto │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-45337 │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────┘

[GlenGengMicrosoft]

@vibhansa-msft @dphulkar-msft Good day to you and this is Glen from Azure CSS team.

One of my customer is asking if we have ETA for the 10.28.0 to release which will contain this fix?

[dphulkar-msft]

Hello,

The AzCopy 10.28.0 release is planned for January 28, 2025.