Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session

Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking.

Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software. The changelog runs to hundreds of entries, so anyone planning to read the whole thing might want to put the kettle on.

Microsoft's release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages. So that's not necessarily 470 separate security holes, but it's still an impressive amount of patching for one release.

The fixes span OpenSSL, curl, Kubernetes, Docker, QEMU, and a lengthy list of other packages that underpin modern Linux environments. The generic Linux kernel has been updated to version 6.6.161.1.

There's also been some housekeeping following the eMudhra certificate incident, tracked …