Microsoft fixes flaw that could leak data between users of Azure container services

Microsoft today revealed it fixed a vulnerability in its Azure Container Instances services that could have been exploited by a malicious user "to access other customers' information." Azure Container Instances (ACI) is a serverless container environment. Microsoft says it offers the flexibility of containers and the security …

[Ken Moorhouse]

employs "more than 3,500 security experts who are dedicated to data security and privacy."

How big is the committee that oversees those experts?

[Sil]

Mitigate not fix

Microsoft did not fix the flaw, it "mitigated it".

[ronkee]

Revoke credentials from August 31, presumably when mitigation started.

Tell users on 9 September to start the process of revoking credentials.

Not especially fast when the mitigation could have alerted someone with a zero day.

At least the really sensitive data probably wasn't in Container Services to begin with.