AZDO.1024 - Disable Node 6 tasks.
Overview
Disable Node 6 tasks.
Rationale: Node.js 6 reached end-of-life in April 2019 and no longer receives security patches. Pipeline tasks that use the Node 6 execution handler run on an unpatched, unsupported runtime, which may expose the pipeline to known vulnerabilities.
Remediation action
Enable the restriction to prevent Node 6 tasks from executing in pipelines.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section "Task restrictions" and turn on "Disable Node 6 tasks"
Results: With this enabled, pipelines will fail if they utilize a task with a Node 6 execution handler.
Related links
- Learn - Prevent malicious code execution
- Learn - Remove Node 6 and Node 10 runners from Microsoft-hosted agents
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1024 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:SI-2 |
| PowerShell test | Test-AzdoOrganizationTaskRestrictionsDisableNode6Task |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/release-notes/roadmap/2022/no-node-6-on-hosted-agents |