Distinguishing Azure Container App vs. Azure App Service Vulnerability Cases - "Duplicate" Submissions?

[gregk4sec]

Advisory Note: Distinguishing Azure Container App vs. Azure App Service Vulnerability Cases

When reviewing recent MSRC case handling, an interesting discrepancy emerges between Case 102650 (Azure Container App) and Case 102586 (Azure App Service).

Background

Case 102650 (Azure Container App) was assessed as "Duplicate" of Case 102586 (Azure App Service).

Observed Timeline

• The Azure Container App case (102650) was remediated promptly — the fix was deployed and verified.
• The Azure App Service case (102586) remained unfixed at the same point in time.

Why This Matters

• Different product surfaces:
  Azure Container App and Azure App Service are not interchangeable. They represent distinct service architectures, with separate engineering pipelines and deployment models.

• Independent remediation paths:
  If the two cases truly shared a single root cause, remediation would have been synchronized. The fact that one product was fixed while the other was not demonstrates that the engineering changes were product‑specific, not universally applicable.

• Classification implications:
  Labeling one case as a duplicate of the other obscures the reality that two separate Azure services required distinct fixes. This risks underreporting the breadth of exposure and misrepresents the scope of remediation.

Takeaway

The evidence suggests that while the vulnerabilities may appear similar, they were not resolved by a single fix. Each product required its own remediation, which underscores the importance of accurate classification across Azure services.

It is necessary to reconsider the factor of submission on Azure Container App as "Duplicate" on Azure App Service.

---