# MA-833.052022: MyCERT Advisory - Microsoft Releases Advisory to Address Vulnerability in Azure Data Factory and Azure Synapse pipelines [CVE-2022-29972]

**Date:** 19 May 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-833.052022  
**Advisory ID:** MA-833.052022

---

**1.0 Introduction**
Microsoft has released an advisory to address CVE-2022-29972, a security flaw affecting Azure Synapse and Azure Data Factory pipelines that could let attackers execute remote commands across Integration Runtime (IR) infrastructure. IR compute infrastructure is used by Azure Synapse and Azure Data Factory pipelines to provide data integration capabilities across network environments (e.g., data flow, activity dispatch, SQL Server Integration Services (SSIS) package execution). The vulnerability was specific to the third-party Open Database Connectivity (ODBC) driver used to connect to Amazon Redshift in Azure Synapse pipelines and Azure Data Factory IR and did not impact Azure Synapse as whole.
**2.0 Impact**
Exploitation of some of these vulnerabilities may allow an attacker to perform remote command execution across IR infrastructure not limited to a single tenant.
**3.0 Affected Products**
Third-party Open Database Connectivity (ODBC) driver used to connect to Amazon Redshift in Azure Synapse pipelines and Azure Data Factory Integration Runtime (IR).
**4.0 Recommendations**
Users and administrators are recommended to review the below URLs and perform the necessary update. Kindly refer to the below URL:
• <https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
• <https://orca.security/resources/blog/azure-synapse-analytics-security-advisory/>
• <https://www.bleepingcomputer.com/news/security/microsoft-releases-fixes-for-azure-flaw-allowing-rce-attacks/>
• <https://aka.ms/SynapsePipelinesUpdate>
• <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972>
• <https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/>
• <https://msrc.microsoft.com/update-guide/vulnerability/ADV220001>