www.vmware.com
Open in
urlscan Pro
2a02:26f0:480:39a::2ef
Public Scan
URL:
https://www.vmware.com/security/advisories/VMSA-2022-0027.html
Submission: On November 01 via api from IN — Scanned from DE
Submission: On November 01 via api from IN — Scanned from DE
Form analysis
2 forms found in the DOM//www.vmware.com/search.html
<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
<input type="text" name="q" id="ub-search" class="d-none" aria-role="searchbox" role="searchbox">
<a href="javascript:void(0);" aria-label="Search vmware.com" class="search-icon ml-lg-3" name="nav_utility : Search">
<i class="fa fa-search text-indigo mr-2 mr-lg-0" aria-hidden="true"></i>
</a>
<input type="hidden" name="num" value="20">
<input type="hidden" name="filter" value="0">
<input type="hidden" name="ie" value="UTF-8">
<input type="hidden" name="oe" value="UTF-8">
<input type="hidden" name="entqr" value="0">
<input type="hidden" name="start" value="0">
<input type="hidden" name="sort" value="">
<input type="hidden" name="tlen" value="200">
<input type="hidden" name="numgm" value="3">
<input type="hidden" name="cn" value="vmware">
<input type="hidden" name="cid" value="">
<input type="hidden" name="tid" value="">
<input type="hidden" name="getfields" value="*">
<input type="hidden" name="partialfields" value="">
<input type="hidden" name="requiredfields" value="">
<input type="hidden" name="place" value="top">
<input type="hidden" name="client" value="VMware_Site_1">
<input type="hidden" name="site" value="VMware_Site_1">
<input type="hidden" name="cc" value="en">
<input type="hidden" name="stype" value="main">
</form>
Name: securitysignup —
<form accept-charset="UNKNOWN" id="securitysignup" name="securitysignup" data-gtm-form-interact-id="0">
<label class="email-input-label" for="securityEmail">*Email</label>
<input id="securityEmail" name="email" size="25" type="text" data-gtm-form-interact-field-id="0">
<span class="subscriptionerrorMsg sa-validation-alerts" tabindex="0"></span>
<input name="email-button" class="sa-subscription-modal-button sa-subscription-submit-button" type="submit" onclick="s_objectID='content_advisories : : 0';" value="Submit">
</form>
Text Content
Skip to Promo Skip to main content Global Search US About Us Resources Store Log in Cloud Services Console Customer Connect Partner Connect * Multi-Cloud Environments * App Platform * Cloud & Edge Infrastructure * Anywhere Workspace * Security & Networking * Partners GET STARTED Main Menu TAKE CONTROL OF YOUR MULTI-CLOUD ENVIRONMENT 73% of enterprises use two or more public clouds today. While multi-cloud accelerates digital transformation, it also introduces complexity and risk. Simplicity Across Clouds Is Rare 91% of executives are looking to improve “consistency across [their] public cloud environments." Applications Need to Be Modernized 68% of developers want to expand use of modern application frameworks, APIs and services. Distributed Work Models Are Here to Stay 72% of enterprise employees are working from non-traditional environments. Security Is a Top-Down Concern Risk related to security, data and privacy issues remains the #1 multi-cloud challenge. SEE HOW VMWARE CAN HELP VMWARE CROSS-CLOUD™ SERVICES ENABLE ORGANIZATIONS TO UNLOCK THE POTENTIAL OF MULTI-CLOUD WITH ENTERPRISE SECURITY AND RESILIENCY. BUILD & OPERATE CLOUD NATIVE APPS Give developers the flexibility to use any app framework and tooling for a secure, consistent and fast path to production on any cloud. CONNECT & SECURE APPS & CLOUDS Deliver security and networking as a built-in distributed service across users, apps, devices, and workloads in any cloud. AUTOMATE & OPTIMIZE APPS & CLOUDS Operate apps and infrastructure consistently, with unified governance and visibility into performance and costs across clouds. ACCESS ANY APP ON ANY DEVICE Empower your employees to be productive from anywhere, with secure, frictionless access to enterprise apps from any device. RUN ENTERPRISE APPS ANYWHERE Run enterprise apps and platform services at scale across public and telco clouds, data centers and edge environments. LEARN ABOUT CROSS-CLOUD SERVICES Main Menu Multi-Cloud Spotlight MODERNIZE FASTER ACROSS CLOUDS MODERNIZE APPS FASTER WITH A MULTI-CLOUD KUBERNETES PLATFORM TO HELP YOU BUILD AND RUN ALL APPS CONSISTENTLY ACROSS CLOUDS. Get on a Faster Path to Prod Build and deploy quickly and securely on any public cloud or on-premises Kubernetes cluster. Simplify Kubernetes Operations Build and operate a secure, multi-cloud container infrastructure at scale. Pair with App Development Experts Unlock value by modernizing your existing apps and building innovative new products. LEARN MORE APP PLATFORM Build, run, secure, and manage all of your apps across any cloud with application modernization solutions and guidance from VMware. Join Us at SpringOne by VMware Tanzu, Dec 6-8 Learn how architects, platform teams and innovators are using the latest tech to get code from idea to reality faster. REGISTER NOW SOLUTIONS & PRODUCTS BOOST DEVELOPER VELOCITY Azure Spring Apps Data Transformation Product Development Rapid Portfolio Modernization Tanzu Application Platform VMware Data Solutions REALIZE DEVSECOPS OUTCOMES Carbon Black Container Tanzu Application Platform Tanzu Service Mesh EMBRACE PLATFORM OPS Platform Development Tanzu for Kubernetes Operations Tanzu Kubernetes Grid Tanzu Mission Control Aria Operations for Applications CONNECT & SECURE MODERN APPS Carbon Black Container Container Networking with Antrea Network Security NSX NSX Advanced Load Balancer Tanzu Service Mesh EMERGE AS A CLOUD NATIVE CSP Telco Cloud Automation Telco Cloud Infrastructure Telco Cloud Platform Telco Cloud Platform – Public Cloud Telco Cloud Platform – RAN Telco Cloud Service Assurance VMware RIC VMWARE DATA SOLUTIONS VMware GemFire VMware RabbitMQ QUICK LINKS All Industries ALL PRODUCTS ALL SOLUTIONS Main Menu Multi-Cloud Spotlight POWER OF ANY CLOUD WITH CONSISTENCY OF ONE ACCELERATE CLOUD TRANSFORMATION WITH AN ENTERPRISE INFRASTRUCTURE, MULTI-CLOUD OPERATIONS AND MODERN APP PLATFORM ACROSS THE EDGE AND ANY CLOUD. Connect and Run with Confidence Reduce time-to-value, lower costs, and enhance security while modernizing your private and public cloud infrastructure. Enhance Digital Experiences Securely, reliably, and optimally connect applications in the cloud and at the edge to deliver unique experiences. LEARN MORE CLOUD & EDGE INFRASTRUCTURE Run enterprise apps at scale with a consistent cloud infrastructure across public clouds, data centers and edge environments. VMware Research: Multi-Cloud Strategies Learn why enterprises find multi-cloud strategies critical for success. SEE INTERACTIVE EBOOK SOLUTIONS & PRODUCTS CLOUD INFRASTRUCTURE EXPLORE VMWARE CLOUD Adopt Multi-Cloud Choose Hybrid Cloud Migrate to the Cloud Transform to Cloud Infrastructure VMware Cloud Universal SELECT CLOUD INFRASTRUCTURE Alibaba Cloud VMware Service Azure VMware Solution Google Cloud VMware Engine IBM Cloud for VMware Solutions Oracle Cloud VMware Solution VMware Cloud on AWS VMware Cloud on AWS GovCloud (US) VMware Cloud on AWS Outposts VMware Cloud on Dell VMware Cloud Disaster Recovery VMware Cloud Flex Storage VMware Cloud Foundation VMware Verified Cloud Providers GET A HYPERCONVERGED INFRASTRUCTURE Dell EMC VxRail NSX NSX Advanced Load Balancer vCenter Server vSAN/vSAN+ vSphere/vSphere+ OPERATE IN THE CLOUD Accelerate Disaster Recovery Automate the Network Deploy a Sovereign Cloud Enable Cloud Adoption Scale Capacity On Demand TRANSFORM TELCO CLOUD Edge Monetization Network Modernization Network Programmability RAN Disaggregation MANAGE THE CLOUD VMware Aria CloudHealth CloudHealth Secure State Skyline Aria Operations for Applications vRealize Automation vRealize Cloud Universal vRealize Log Insight vRealize Network Insight vRealize Operations vRealize Suite SECURE CLOUD WORKLOADS Carbon Black Container Carbon Black Workload CloudHealth Secure State NSX Advanced Load Balancer NSX Distributed Firewall NSX Distributed IDS/IPS EDGE ENABLE THE MULTI-CLOUD EDGE Edge Compute Stack Edge Network Intelligence Empower Remote Work Optimize and Secure the WAN SD-WAN Secure Access Secure Access Service Edge (SASE) Telco Edge VMware Cloud Web Security VMWARE DATA SOLUTIONS VMware Greenplum VMware SQL QUICK LINKS All Industries Cloud Platform Tech Zone VMware Tech Zone VMware Marketplace ALL PRODUCTS ALL SOLUTIONS Main Menu Multi-Cloud Spotlight MULTI-CLOUD & ANYWHERE WORKSPACE EMPOWER YOUR EMPLOYEES TO BE PRODUCTIVE FROM ANYWHERE, WITH SECURE, FRICTIONLESS ACCESS TO ENTERPRISE APPS FROM ANY DEVICE. Deliver an Engaging Experience Put employees first with device choice, flexibility, and seamless, consistent, high-quality experiences. Secure Today’s Anywhere Workspace Ease the move to Zero Trust with situational intelligence and connected control points. Accelerate IT Modernization Manage to outcomes — not tasks — with intelligent compliance, workflow and performance management. LEARN MORE ANYWHERE WORKSPACE Enable any employee to work from anywhere, anytime with seamless employee experiences. Remote Work Is No Longer Optional Shift from supporting remote work to becoming an anywhere organization. DOWNLOAD BRIEF SOLUTIONS & PRODUCTS EMBRACE ANYWHERE WORKSPACE Digital Employee Experience Virtual Desktops and Applications Workspace Security Unified Endpoint Management ENSURE EXPERIENCE AND PRODUCTIVITY Workspace ONE Workspace ONE Intelligent Hub Workspace ONE Productivity Apps MODERNIZE ENDPOINT MANAGEMENT Workspace ONE Workspace ONE UEM Workspace ONE UEM for Mac Workspace ONE for Windows SCALE WITH VDI & DAAS Horizon Horizon Cloud EMPOWER FRONTLINE WORKERS Workspace ONE Workspace ONE Launcher Workspace ONE for Rugged Devices Workspace ONE UEM Workspace ONE for Workspace IoT Endpoints SECURE THE HYBRID WORKFORCE Mobile Threat Defense PLATFORM SERVICES Workspace ONE Access Workspace ONE Assist Workspace ONE Assist for Horizon Workspace ONE Freestyle Orchestrator Workspace ONE Intelligence SaaS App Management DESKTOP HYPERVISOR Fusion for Mac Workstation Player Workstation Pro QUICK LINKS All Industries Workspace Tech Zone EUC Blog End User Adoption Digital Workspace ALL PRODUCTS ALL SOLUTIONS Main Menu Multi-Cloud Spotlight MULTI-CLOUD SECURITY & NETWORKING WITH CONNECTED SECURITY THAT DELIVERS FULL VISIBILITY AND FRICTIONLESS OPERATIONS, YOUR APPS AND DATA ARE MORE SECURE WITH VMWARE, IN ANY ENVIRONMENT. Secure & Connect Workloads Operationalize consistent security and networking across apps, users, and entities with transparency built into our tools. Protect APIs — the New Endpoints Increase app velocity and centrally manage, secure, connect, and govern your clusters no matter where they reside. Be Future-Ready Get built-in threat intelligence spanning users, endpoints and networks to evolve your protection in a dynamic landscape. LEARN MORE SECURITY & NETWORKING Deliver security and networking as a built-in distributed service across users, apps, devices, and workloads in any cloud. Protect Your Multi-Cloud Environments Discover the unique characteristics of malware and how to stay ahead of attacks. GET THREAT REPORT SOLUTIONS & PRODUCTS SECURITY MODERNIZE THE SOC Carbon Black Cloud Carbon Black Endpoint Carbon Black MDR NSX Distributed IDS/IPS NSX Network Detection and Response NSX Sandbox Security Professional Services SECURE MULTI-CLOUD WORKLOADS Carbon Black App Control Carbon Black Container Carbon Black Workload CloudHealth Secure State NSX Advanced Load Balancer NSX Distributed Firewall NSX Distributed IDS/IPS NSX Gateway Firewall Ransomware Protection SECURE MODERN APPS Carbon Black Container Container Networking with Antrea NSX Advanced Load Balancer Tanzu Service Mesh SECURE THE HYBRID WORKFORCE Carbon Black App Control Carbon Black Endpoint SASE Platform SD-WAN Secure Access NETWORKING ENABLE CLOUD NETWORKING DPU-based Acceleration for NSX NSX NSX Advanced Load Balancer NSX Firewall RETHINK MODERN APP DELIVERY NSX Advanced Load Balancer CONNECT AND SECURE MODERN APPS Container Networking with Antrea NSX Advanced Load Balancer Tanzu Service Mesh STRENGTHEN APP & NETWORK ACCESS Edge Network Intelligence Empower Remote Work Optimize and Secure the WAN SD-WAN Secure Access Secure Access Service Edge (SASE) VMware Cloud Web Security SECURE YOUR NETWORK NSX Firewall NSX Distributed IDS/IPS NSX Network Detection & Response NSX Sandbox SIMPLIFY NETWORK OPS AND AUTOMATION Global Network Identities HCX Workload Mobility NSX Intelligence vRealize Network Insight QUICK LINKS All Industries Carbon Black Tech Zone NSX Tech Zone ALL PRODUCTS ALL SOLUTIONS Main Menu Multi-Cloud Spotlight TRUSTED ADVISORS ON MULTI-CLOUD JOURNEY PARTNERS ARE TRUSTED ADVISORS TO GUIDE CUSTOMERS’ JOURNEYS TO MULTI-CLOUD, ENABLING DIGITAL INNOVATION WITH ENTERPRISE CONTROL. Work with a VMware Partner Partners deliver outcomes with their expertise and VMware technology, creating exceptional value for our mutual customers. Become a Partner Together with our partners, VMware is building the new multi-cloud ecosystem positioned to become essential to our customers. LEARN MORE PARTNERS With thousands of partners worldwide, we are positioned to help customers scale their business, drive innovation and transform their customer experience. Working Together with Partners for Customer Success See how we work with a global partner to help companies prepare for multi-cloud. VIEW PARTNER STORY SOLUTIONS FOR CUSTOMERS Find a Cloud Provider Find a Partner VMware Marketplace Work with a Partner FOR PARTNERS Become a Cloud Provider Cloud Partner Navigator Get Cloud Verified Learning and Selling Resources Partner Connect Login Partner Executive Edge Technology Partner Hub Work with VMware Ellipsis VMware Security Solutions Advisories VMSA-2022-0027.1 Critical Advisory ID: VMSA-2022-0027.1 CVSSv3 Range: 5.3-9.8 Issue Date: 2022-10-25 Updated On: 2022-10-27 CVE(s): CVE-2021-39144, CVE-2022-31678 Synopsis: VMware Cloud Foundation updates address multiple vulnerabilities. RSS Feed Download PDF Download Text File Share this page on social media: Sign up for Security Advisories SIGN UP FOR SECURITY ADVISORIES Stay up to date on the latest VMware Security advisories and updates. Close *Email 1. IMPACTED PRODUCTS * VMware Cloud Foundation (Cloud Foundation) 2. INTRODUCTION Multiple vulnerabilities were privately reported to VMware. Updates are available to address this vulnerability in affected VMware products. 3A. VMWARE CLOUD FOUNDATION UPDATE ADDRESSES A REMOTE CODE EXECUTION VULNERABILITY VIA XSTREAM (CVE-2021-39144) Description VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Known Attack Vectors Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of 'root' on the appliance. Resolution To remediate CVE-2021-39144 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below. Workarounds None. Additional Documentation A supplemental FAQ was created for additional clarification. Please see: https://kb.vmware.com/s/article/89932 Notes * While VMware does not mention end-of-life products on VMware Security Advisories, due to the critical severity of NSX-V the product team has made a patch available. * VMware has confirmed that exploit code leveraging CVE-2021-39144 against impacted products has been published. Acknowledgements VMware would like to thank Sina Kheirkhah and Steven Seeley of Source Incite for reporting these issues to us. Response Matrix Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation VMware Cloud Foundation 4.x Any CVE-2021-39144 N/A N/A Unaffected N/A N/A VMware Cloud Foundation (NSX-V) 3.11 Any CVE-2021-39144 9.8 critical KB 89809 None FAQ 3B. VMWARE CLOUD FOUNDATION UPDATE ADDRESSES AN XML EXTERNAL ENTITY (XXE) VULNERABILITY (CVE-2022-31678) Description VMware Cloud Foundation contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3. Known Attack Vectors An unauthenticated user may exploit this issue leading to a denial-of-service condition or unintended information disclosure. Resolution To remediate CVE-2022-31678 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below. Workarounds None Additional Documentation None. Notes None. Acknowledgements VMware would like to thank Sina Kheirkhah and Steven Seeley of Source Incite for reporting these issues to us. Response Matrix Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation VMware Cloud Foundation 4.x Any CVE-2022-31678 N/A N/A Unaffected N/A N/A VMware Cloud Foundation (NSX-V) 3.11 Any CVE-2022-31678 5.3 moderate KB 89809 None None. 4. REFERENCES Fixed Version(s) and Release Notes: VMware vCloud Foundation 3.11 Downloads and Documentation: https://docs.vmware.com/en/VMware-Cloud-Foundation/3.11/rn/vmware-cloud-foundation-311-release-notes/index.html Mitre CVE Dictionary Links: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39144 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31678 FIRST CVSSv3 Calculator: CVE-2021-39144: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-31678: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5. CHANGE LOG 2022-10-25 VMSA-2022-0027 Initial security advisory. 2022-10-27 VMSA-2022-0027.1 Updated advisory with information that VMware has confirmed exploit code leveraging CVE-2021-39144 against VCF (NSX-V) has been published. 6. CONTACT E-mail list for product security notifications and announcements: https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce@lists.vmware.com bugtraq@securityfocus.com fulldisclosure@seclists.org E-mail: security@vmware.com PGP key at: https://kb.vmware.com/kb/1055 VMware Security Advisories https://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html VMware Security & Compliance Blog https://blogs.vmware.com/security Twitter https://twitter.com/VMwareSRC Copyright 2022 VMware Inc. All rights reserved. Company About Us Executive Leadership News & Stories Investor Relations Customer Stories Diversity, Equity & Inclusion Environment, Social & Governance Careers Blogs Communities Acquisitions Office Locations VMware Cloud Trust Center COVID-19 Resources Support VMware Customer Connect Support Policies Product Documentation Compatibility Guide End User Terms & Conditions California Transparency Act Statement Twitter YouTube Facebook LinkedIn Contact Sales -------------------------------------------------------------------------------- © 2022 VMware, Inc. Terms of Use Your California Privacy Rights Privacy Accessibility Site Map Trademarks Glossary Help Feedback Cookie Settings We use cookies to provide you with the best experience on our website, to improve usability and performance and thereby improve what we offer to you. Our website may also use third-party cookies to display advertising that is more relevant to you. By clicking on the “Accept All” button you agree to the storing of cookies on your device. If you want to know more about how we use cookies, please see our Cookie Policy. Cookie Settings Accept All Cookies COOKIE PREFERENCE CENTER GENERAL INFORMATION ON COOKIES GENERAL INFORMATION ON COOKIES When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our Cookie Policy. * STRICTLY NECESSARY STRICTLY NECESSARY Always Active Strictly Necessary Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org. Cookie Details * PERFORMANCE PERFORMANCE Performance Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate. Cookie Details * FUNCTIONAL FUNCTIONAL Functional Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly. Cookie Details * ADVERTISING ADVERTISING Advertising Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device. Cookie Details * SOCIAL MEDIA SOCIAL MEDIA Social Media Social media cookies are intended to facilitate the sharing of content and to improve the user experience. These cookies can sometimes track your activities. We do not control social media cookies and they do not allow us to gain access to your social media accounts. Please refer to the relevant social media platform’s privacy policies for more information. Cookie Details Back Button ADVERTISING COOKIES Filter Button Consent Leg.Interest Select All Vendors Select All Vendors Select All Hosts Select All * REPLACE-WITH-DYANMIC-HOST-ID View Third Party Cookies * Name cookie name Clear Filters Information storage and access Apply Confirm My Choices Allow All word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1