[neerajbalodiillumio]

Summary

Remediates two High-severity urllib3 vulnerabilities (CVE-2026-97687, CVE-2026-97689) in the IllumioSaaS solution. urllib3 ships transitively via aiobotocore; this bumps aiobotocore so a patched urllib3 (>= 2.8.0) resolves, and rebuilds the function app packages with the patched dependencies.

Vulnerabilities

• CVE-2026-97687 (GHSA-8988-9cw3-xx77) — HTTPS proxy TLS settings incorrectly applied to the proxy connection. Fixed in urllib3 2.8.0.
• CVE-2026-97689 (GHSA-vxq7-64xx-v4gw) — unbounded memory allocation in chunked response parsing. Fixed in urllib3 2.8.0. Detected via the transitive chain: aiobotocore 2.12.1 → botocore 1.34.51 → urllib3 2.0.7.

Changes

• requirements.txt: aiobotocore==2.26.0 + explicit urllib3>=2.8.0
• Rebuilt IllumioEventsConn.zip and IllumioQueueTrigger.zip with patched Linux dependencies (urllib3 2.8.0, aiobotocore 2.26.0, botocore 1.41.5)
• Bumped solution version 3.4.1 → 3.4.2, added ReleaseNotes entry
• Regenerated solution package via the V3 packaging tool (mainTemplate.json, createUiDefinition.json, testParameters.json)

Why bump aiobotocore rather than override urllib3

Pinning urllib3>=2.8.0 against aiobotocore==2.12.1 is not installable — botocore 1.34.51 pins urllib3 <2.1. Upgrading aiobotocore to 2.26.0 pulls botocore 1.41.5, whose constraint allows urllib3 2.8.0.

Testing

• Clean dependency resolution; pip-audit clear of both CVEs.
• Validated end-to-end on an Azure Function App via WEBSITE_RUN_FROM_PACKAGE using the rebuilt package: SQS → S3 → gunzip → Sentinel ingestion confirmed; events landed in Illumio_Flow_Events_CL. No regressions.

[neerajbalodiillumio]

neerajbalodiillumio please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Illumio"

[Copilot]

🔵 Needs a closer look

The core security remediation and deployment artifacts require maintainer verification outside the permitted review scope.

No open issues 🎉

What changed in this PR

Updates the IllumioSaaS Microsoft Sentinel solution to version 3.4.2 with dependency changes intended to remediate the reported urllib3 vulnerabilities.

Changes:

• Upgrades aiobotocore to 2.26.0 and requires urllib3>=2.8.0.
• Updates the solution version and documents the security remediation.
• Regenerates deployment artifacts with content-selection controls.

Connector and generated package files are excluded from the configured review scope.

File	Description
Solutions/​IllumioSaaS/​ReleaseNotes.md	Documents the 3.4.2 security update.
Solutions/​IllumioSaaS/​Package/​testParameters.json	Adds content-deployment switches; excluded from review.
Solutions/​IllumioSaaS/​Package/​mainTemplate.json	Updates package version and deployment conditions; excluded from review.
Solutions/​IllumioSaaS/​Package/​createUiDefinition.json	Adds content-selection controls; excluded from review.
Solutions/​IllumioSaaS/​data/​Solution_IllumioSaaS.json	Sets the source solution version to 3.4.2.
Solutions/​IllumioSaaS/​Data Connectors/​requirements.txt	Updates dependency requirements; excluded from review.

_{Review effort: Balanced}

[neerajbalodiillumio]

v-skharode, could you please let me know if there’s anything needed from my end? Also, could you share an estimated timeline for when the review is expected to be completed? Thank you!

[v-skharode]

Hi neerajbalodiillumio
Just reviewing the PR, will let know if required changes are needed.

[v-skharode]

The version and release-note changes look consistent. I’m checking the failed ARM-TTK and Data Connector validations before completing the review. Please share the detailed errors from those checks and the dependency-audit evidence for the rebuilt packages.

[neerajbalodiillumio]

The version and release-note changes look consistent. I’m checking the failed ARM-TTK and Data Connector validations before completing the review. Please share the detailed errors from those checks and the dependency-audit evidence for the rebuilt packages.

v-skharode, thanks for reviewing. Looking into the two failed checks:

1. ARM-TTK — the failure is a CI container build error (buildx failed... entrypoint.ps1 exit code 1), i.e. the Docker image for the ARM-TTK runner failed to build before any template validation ran. This is an environment/infra failure, not a template issue.

2. DataConnectorValidations — the failure is a GitHub API rate-limit error (API rate limit exceeded for 52.159.161.234 ... exit code 255), a transient CI throttling issue unrelated to the PR content.

Both appear to be transient CI infrastructure failures rather than problems with the changes. Could you please re-run the failed checks? They should pass on retry.

Dependency-audit evidence for the rebuilt packages:

• Rebuilt IllumioEventsConn.zip and IllumioQueueTrigger.zip now bundle urllib3 2.8.0, aiobotocore 2.26.0, botocore 1.41.5; the vulnerable urllib3 2.0.7 is removed (confirmed via unzip -l ... | grep urllib3 on both — 0 occurrences of 2.0.7).
• pip-audit against the updated requirements.txt reports no known vulnerabilities for urllib3 (CVE-2026-97687 and CVE-2026-97689 cleared).
• Validated end-to-end on an Azure Function App via WEBSITE_RUN_FROM_PACKAGE using the rebuilt package — SQS → S3 → Logs Ingestion pipeline confirmed, test event landed in Illumio_Flow_Events_CL with no regression.

[v-skharode]

Hey neerajbalodiillumio
Thanks for rerunning the checks. Data Connector Validations now pass, but ARM-TTK still fails during the container build. Could you investigate with the maintainers and rerun it once resolved?

[neerajbalodiillumio]

Hey neerajbalodiillumio Thanks for rerunning the checks. Data Connector Validations now pass, but ARM-TTK still fails during the container build. Could you investigate with the maintainers and rerun it once resolved?

Hi v-skharode , thank you for re-running the checks earlier.

Pushed a follow-up commit to fix the ARM-TTK failure. The apiVersions Should Be Recent In Reference Functions test was failing on a listKeys() call using Storage API version 2023-04-01 (>730 days old). Bumped it to 2025-01-01 in the Playbook source and regenerated mainTemplate.json. Verified locally with arm-ttk 20260213 + the Sentinel exemption filters: Pass=32, Fail=0.