www.vmware.com Open in urlscan Pro
2a02:26f0:7100:8a9::2ef  Public Scan

Form analysis
3 forms found in the DOM

//www.vmware.com/search.html

<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
  <input type="text" name="q" id="ub-search" class="d-none" placeholder="Search" title="Search" aria-role="searchbox" role="searchbox">
  <a href="javascript:void(0);" aria-label="Search vmware.com" class="search-icon ml-lg-3" name="nav_utility : Search">

									<i class="fa fa-search text-indigo mr-2 mr-lg-0" aria-hidden="true"></i>
								 </a>
  <input type="hidden" name="num" value="20">
  <input type="hidden" name="filter" value="0">
  <input type="hidden" name="ie" value="UTF-8">
  <input type="hidden" name="oe" value="UTF-8">
  <input type="hidden" name="entqr" value="0">
  <input type="hidden" name="start" value="0">
  <input type="hidden" name="sort" value="">
  <input type="hidden" name="tlen" value="200">
  <input type="hidden" name="numgm" value="3">
  <input type="hidden" name="cn" value="vmware">
  <input type="hidden" name="cid" value="">
  <input type="hidden" name="tid" value="">
  <input type="hidden" name="getfields" value="*">
  <input type="hidden" name="partialfields" value="">
  <input type="hidden" name="requiredfields" value="">
  <input type="hidden" name="place" value="top">
  <input type="hidden" name="client" value="VMware_Site_1">
  <input type="hidden" name="site" value="VMware_Site_1">
  <input type="hidden" name="cc" value="en">
  <input type="hidden" name="stype" value="main">
</form>

//www.vmware.com/search.html

<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
  <a href="javascript:void(0);" tabindex="-1" class="search-icon ml-lg-3" name="nav_utility : Search">
      </a>
  <input type="text" name="q" id="ub-search" placeholder="Search" title="Search" role="searchbox">
  <input type="hidden" name="num" value="20">
  <input type="hidden" name="filter" value="0">
  <input type="hidden" name="ie" value="UTF-8">
  <input type="hidden" name="oe" value="UTF-8">
  <input type="hidden" name="entqr" value="0">
  <input type="hidden" name="start" value="0">
  <input type="hidden" name="sort" value="">
  <input type="hidden" name="tlen" value="200">
  <input type="hidden" name="numgm" value="3">
  <input type="hidden" name="cn" value="vmware">
  <input type="hidden" name="cid" value="">
  <input type="hidden" name="tid" value="">
  <input type="hidden" name="getfields" value="*">
  <input type="hidden" name="partialfields" value="">
  <input type="hidden" name="requiredfields" value="">
  <input type="hidden" name="place" value="top">
  <input type="hidden" name="client" value="VMware_Site_1">
  <input type="hidden" name="site" value="VMware_Site_1">
  <input type="hidden" name="cc" value="en">
  <input type="hidden" name="stype" value="main">
</form>

Name: securitysignup —

<form accept-charset="UNKNOWN" id="securitysignup" name="securitysignup" data-gtm-form-interact-id="0">
  <label class="email-input-label" for="securityEmail">*Email</label>
  <input id="securityEmail" name="email" size="25" type="text" data-gtm-form-interact-field-id="0">
  <span class="subscriptionerrorMsg sa-validation-alerts" tabindex="0"></span>
  <input name="email-button" class="sa-subscription-modal-button sa-subscription-submit-button" type="submit" onclick="s_objectID='content_advisories :  : 0';" value="Submit">
</form>

Text Content

Skip to Promo Skip to main content
Global Search

US Store
Login
Cloud Services Console Customer Connect Partner Connect
 * Multi-Cloud Services
 * Products
 * Solutions
 * Partners
 * Resources

GET STARTED
Global Search

Main Menu

TODAY’S MULTI-CLOUD REALITY: CLOUD CHAOS

87% OF ENTERPRISES USE TWO OR MORE CLOUD ENVIRONMENTS TO RUN THEIR APPLICATIONS.
MULTI-CLOUD ACCELERATES DIGITAL TRANSFORMATION, BUT ALSO INTRODUCES COMPLEXITY
AND RISK, RESULTING IN A CHAOTIC REALITY FOR MANY ORGANIZATIONS.

LEARN ABOUT MULTI-CLOUD

CONQUER CLOUD CHAOS WITH VMWARE CROSS-CLOUD SERVICES



VMware is addressing cloud chaos with our portfolio of multi-cloud services,
VMware Cross-Cloud services, which enable you to build, run, manage, secure, and
access applications consistently across cloud environments.

With VMware Cross-Cloud services, you can address cloud chaos and shift to a
cloud smart approach – one where you can choose the best environment for every
application, without multiplying your complexity.


LEARN HOW CROSS-CLOUD SERVICES CAN HELP

Main Menu

ANYWHERE WORKSPACE

Access Any App on Any Device Securely

 * Horizon
 * Horizon Cloud
 * Workspace ONE
 * Workspace ONE UEM

APP PLATFORM

Build and Operate Cloud Native Apps

 * Tanzu

CLOUD & EDGE INFRASTRUCTURE

Run Enterprise Apps Anywhere

 * Cloud Foundation/Cloud Foundation+
 * SD-WAN/SASE
 * Telco Cloud
 * vSAN/vSAN+
 * vSphere/vSphere+
 * VMware Cloud
 * VMware Cloud Disaster Recovery

CLOUD MANAGEMENT

Automate and Optimize Apps and Clouds

 * VMware Aria
 * CloudHealth
 * Skyline

DESKTOP HYPERVISOR

Manage apps in a local virtualization sandbox

 * Fusion for Mac
 * Workstation Player
 * Workstation Pro

SECURITY & NETWORKING

Connect and Secure Apps and Clouds

 * Carbon Black Cloud
 * Carbon Black Endpoint
 * NSX/NSX+
 * NSX Advanced Load Balancer
 * NSX Distributed Firewall

RUN VMWARE ON ANY CLOUD. ANY ENVIRONMENT. ANYWHERE.

ON PUBLIC & HYBRID CLOUDS

 * Alibaba Cloud VMware Service
 * Azure VMware Solution
 * Google Cloud VMware Engine
 * IBM Cloud for VMware Solutions
 * Oracle Cloud VMware Solutions
 * VMware Cloud on AWS
 * VMware Cloud on AWS GovCloud (US)

ON PRIVATE & LOCAL CLOUDS

 * Dell EMC VxRail
 * VMware Cloud on Equinix Metal
 * VMware on AWS Outposts
 * VMware Verified Cloud Providers


SEE ALL PRODUCTS SEE PRICING
 * SaaS (Subscription) product version available

Main Menu

SOLUTIONS

ANYWHERE WORKSPACE

ACCESS ANY APP ON ANY DEVICE SECURELY

APP PLATFORM

BUILD AND OPERATE CLOUD NATIVE APPS

CLOUD INFRASTRUCTURE

RUN ENTERPRISE APPS ANYWHERE

CLOUD MANAGEMENT

AUTOMATE AND OPTIMIZE APPS AND CLOUDS

EDGE INFRASTRUCTURE

ENABLE THE MULTI-CLOUD EDGE

NETWORKING

ENABLE CONNECTIVITY FOR APPS AND CLOUDS

SECURITY

SECURE APPS AND CLOUDS

BY INDUSTRY

 * Communications Service Providers
 * Department of Defense
 * Federal Government
 * Financial Services
 * Healthcare Providers
 * State and Local Government

VMWARE AI SOLUTIONS

Accelerate and ensure the success of your generative AI initiatives with
multi-cloud flexibility, choice, privacy and control.

LEARN MORE

SEE ALL SOLUTIONS SEE ALL INDUSTRIES
Main Menu

FOR CUSTOMERS

 * Find a Cloud Provider
 * Find a Partner
 * VMware Marketplace
 * Work with a Partner

FOR PARTNERS

 * Become a Cloud Provider
 * Cloud Partner Navigator
 * Get Cloud Verified
 * Learning and Selling Resources
 * Partner Connect Login
 * Partner Executive Edge
 * Technology Partner Hub
 * Work with VMware

WORKING TOGETHER WITH PARTNERS FOR CUSTOMER SUCCESS

See how we work with a global partner to help companies prepare for multi-cloud.

VIEW PARTNER STORY

Main Menu

TOOLS & TRAINING

 * VMware Customer Connect
 * VMware Trust Center
 * Learning & Certification
 * Tech Zone
 * Product Downloads
 * Product Trials
 * Cloud Services Engagement Platform
 * Hands-on Labs

SERVICES

 * Professional Services
 * Customer Success

SUPPORT

 * VMware Customer Connect
 * Support Offerings
 * Skyline
 * Support Customer Welcome Center

MARKETPLACE

 * Cloud Marketplace
 * VMware Marketplace

VIDEOS

 * VMware Video Library
 * VMware Explore Video Library

BLOGS & COMMUNITIES

 * Blogs
 * Podcasts
 * News & Stories
 * Communities

CUSTOMERS

 * Customer Stories

EVENTS

 * VMware Explore
 * SpringOne
 * All Events & Webcasts


SEE ALL RESOURCES
Ellipsis
VMware Security Solutions  Advisories  VMSA-2021-0002



Critical

Advisory ID: VMSA-2021-0002
CVSSv3 Range: 5.3-9.8
Issue Date: 2021-02-23
Updated On: 2021-02-23 (Initial Advisory)
CVE(s): CVE-2021-21972, CVE-2021-21973, CVE-2021-21974
Synopsis: VMware ESXi and vCenter Server updates address multiple security
vulnerabilities (CVE-2021-21972, CVE-2021-21973, CVE-2021-21974)

RSS Feed

Download PDF

Download Text File

Share this page on social media:



Sign up for Security Advisories

SIGN UP FOR SECURITY ADVISORIES

Stay up to date on the latest VMware Security advisories and updates.





Close
*Email

1. IMPACTED PRODUCTS

 * VMware ESXi
 * VMware vCenter Server (vCenter Server)
   
 * VMware Cloud Foundation (Cloud Foundation)
   

2. INTRODUCTION

Multiple vulnerabilities in VMware ESXi and vSphere Client (HTML5) were
privately reported to VMware. Updates are available to remediate these
vulnerabilities in affected VMware products.


3A. VMWARE VCENTER SERVER UPDATES ADDRESS REMOTE CODE EXECUTION VULNERABILITY IN
THE VSPHERE CLIENT (CVE-2021-21972)

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability in
a vCenter Server plugin. VMware has evaluated the severity of this issue to be
in the Critical severity range with a maximum CVSSv3 base score of 9.8.


Known Attack Vectors

A malicious actor with network access to port 443 may exploit this issue to
execute commands with unrestricted privileges on the underlying operating system
that hosts vCenter Server. 

Resolution

To remediate CVE-2021-21972 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to affected deployments.


Workarounds

Workarounds for CVE-2021-21972 have been listed in the 'Workarounds' column of
the 'Response Matrix' below.


Additional Documentation

None.

Notes

The affected vCenter Server plugin for vROPs is available in all default
installations. vROPs does not need be present to have this endpoint available.
Follow the workarounds KB to disable it.


Acknowledgements

VMware would like to thank Mikhail Klyuchnikov of Positive Technologies for
reporting this issue to us.


Response Matrix:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
vCenter Server
7.0
Any
CVE-2021-21972
9.8
critical
7.0 U1c
KB82374
None
vCenter Server
6.7
Any
CVE-2021-21972
9.8
critical
6.7 U3l
KB82374
None
vCenter Server
6.5
Any
CVE-2021-21972
9.8
critical
6.5 U3n
KB82374
None

Impacted Product Suites that Deploy Response Matrix 3a Components:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
Cloud Foundation (vCenter Server)
4.x
Any
CVE-2021-21972
9.8
critical
4.2
KB82374
None
Cloud Foundation (vCenter Server)
3.x
Any
CVE-2021-21972
9.8
critical
3.10.1.2
KB82374
None

3B. ESXI OPENSLP HEAP-OVERFLOW VULNERABILITY (CVE-2021-21974)

Description

OpenSLP as used in ESXi has a heap-overflow vulnerability. VMware has evaluated
the severity of this issue to be in the Important severity range with a maximum
CVSSv3 base score of 8.8.


Known Attack Vectors

A malicious actor residing within the same network segment as ESXi who has
access to port 427 may be able to trigger the heap-overflow issue in OpenSLP
service resulting in remote code execution.


Resolution

To remediate CVE-2021-21974 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to affected deployments.


Workarounds

Workarounds for CVE-2021-21974 have been listed in the 'Workarounds' column of
the 'Response Matrix' below.


Additional Documentation

None.

Notes

[1] Per the Security Configuration Guides for VMware vSphere, VMware now
recommends disabling the OpenSLP service in ESXi if it is not used. For more
information, see our blog
posting: https://blogs.vmware.com/vsphere/2021/02/evolving-the-vmware-vsphere-security-configuration-guides.html

[2] KB82705 documents steps to consume ESXi hot patch asynchronously on top of
latest VMware Cloud Foundation (VCF) supported ESXi build. 


Acknowledgements

VMware would like to thank Lucas Leong (@_wmliang_) of Trend Micro's Zero Day
Initiative for reporting this issue to us.


Response Matrix:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
[1] ESXi
7.0
Any
CVE-2021-21974
8.8
important
ESXi70U1c-17325551
KB76372
None
[1] ESXi
6.7
Any
CVE-2021-21974
8.8
important
ESXi670-202102401-SG
KB76372
None
[1] ESXi
6.5
Any
CVE-2021-21974
8.8
important
ESXi650-202102101-SG
KB76372
None

Impacted Product Suites that Deploy Response Matrix 3b Components:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
[1] Cloud Foundation (ESXi)
4.x
Any
CVE-2021-21974
8.8
important
4.2
KB76372
None
[1] Cloud Foundation (ESXi)
3.x
Any
CVE-2021-21974
8.8
important
[2] KB82705
KB76372
None

3C. VMWARE VCENTER SERVER UPDATES ADDRESS SSRF VULNERABILITY IN THE VSPHERE
CLIENT (CVE-2021-21973)

Description

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery)
vulnerability due to improper validation of URLs in a vCenter Server
plugin. VMware has evaluated the severity of this issue to be in the Moderate
severity range with a maximum CVSSv3 base score of 5.3.


Known Attack Vectors

A malicious actor with network access to port 443 may exploit this issue by
sending a POST request to vCenter Server plugin leading to information
disclosure.


Resolution

To remediate CVE-2021-21973 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to affected deployments.


Workarounds

Workarounds for CVE-2021-21973 have been listed in the 'Workarounds' column of
the 'Response Matrix' below.


Additional Documentation

None.

Notes

The affected vCenter Server plugin for vROPs is available in all default
installations. vROPs does not need be present to have this endpoint available.
Follow the workarounds KB to disable it.


Acknowledgements

VMware would like to thank Mikhail Klyuchnikov of Positive Technologies for
reporting this issue to us.


Response Matrix:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
vCenter Server
7.0
Any
CVE-2021-21973
5.3
moderate
7.0 U1c
KB82374
None
vCenter Server
6.7
Any
CVE-2021-21973
5.3
moderate
6.7 U3l
KB82374
None
vCenter Server
6.5
Any
CVE-2021-21973
5.3
moderate
6.5 U3n
KB82374
None

Impacted Product Suites that Deploy Response Matrix 3c Components:

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
Cloud Foundation (vCenter Server)
4.x
Any
CVE-2021-21973
5.3
moderate
4.2
KB82374
None
Cloud Foundation (vCenter Server)
3.x
Any
CVE-2021-21973
5.3
moderate
3.10.1.2
KB82374
None

4. REFERENCES

VMware ESXi 7.0 ESXi70U1c-17325551
https://my.vmware.com/group/vmware/patch
https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-esxi-70u1c.html

 

VMware ESXi 6.7 ESXi670-202102401-SG
https://my.vmware.com/group/vmware/patch
https://docs.vmware.com/en/VMware-vSphere/6.7/rn/esxi670-202102001.html


 

VMware ESXi 6.5 ESXi650-202102101-SG
https://my.vmware.com/group/vmware/patch
https://docs.vmware.com/en/VMware-vSphere/6.5/rn/esxi650-202102001.html


 

VMware vCloud Foundation 4.2
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Cloud-Foundation/4.2/rn/VMware-Cloud-Foundation-42-Release-Notes.html


VMware vCloud Foundation 3.10.1.2
Downloads and Documentation:
https://docs.vmware.com/en/VMware-Cloud-Foundation/3.10.1/rn/VMware-Cloud-Foundation-3101-Release-Notes.html


vCenter Server 7.0.1 Update 1
Downloads and Documentation:
https://my.vmware.com/web/vmware/downloads/details?downloadGroup=VC70U1C&productId=974
https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-vcenter-server-70u1c-release-notes.html

 

vCenter Server 6.7 U3l
Downloads and Documentation:
https://my.vmware.com/web/vmware/downloads/details?downloadGroup=VC67U3L&productId=742&rPId=57171
https://docs.vmware.com/en/VMware-vSphere/6.7/rn/vsphere-vcenter-server-67u3l-release-notes.html

 

vCenter Server 6.5 U3n
Downloads and Documentation:
https://my.vmware.com/web/vmware/downloads/details?downloadGroup=VC65U3N&productId=614&rPId=60942
https://docs.vmware.com/en/VMware-vSphere/6.5/rn/vsphere-vcenter-server-65u3n-release-notes.html

 

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21972
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21973
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21974

 

FIRST CVSSv3 Calculator:
CVE-2021-21972: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-21973: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2021-21974: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H


 

5. CHANGE LOG

2021-02-23 VMSA-2021-0002
Initial security advisory.

6. CONTACT

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

 

This Security Advisory is posted to the following lists:  

security-announce@lists.vmware.com  

bugtraq@securityfocus.com  

fulldisclosure@seclists.org 

 

E-mail: security@vmware.com

PGP key at:

https://kb.vmware.com/kb/1055 

 

VMware Security Advisories

https://www.vmware.com/security/advisories 

 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

 

Twitter

https://twitter.com/VMwareSRC


 

Copyright 2021 VMware Inc. All rights reserved.
 


Company

 * About Us
 * Executive Leadership
 * News & Stories
 * Investor Relations
 * Customer Stories
 * Diversity, Equity & Inclusion
 * Environment, Social & Governance
 * AI at VMware

 * Careers
 * Blogs
 * Communities
 * Acquisitions
 * Office Locations
 * VMware Cloud Trust Center
 * COVID-19 Resources

Support

 * VMware Customer Connect
 * Support Policies
 * Product Documentation
 * Compatibility Guide
 * Terms & Conditions
 * California Transparency Act Statement
 * Hands-on Labs & Trials

 * Twitter
 * YouTube
 * Facebook
 * LinkedIn
 * Contact Sales

--------------------------------------------------------------------------------

Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers
to Broadcom Inc. and/or its subsidiaries. Terms of Use Your California Privacy
Rights Privacy Accessibility Trademarks Glossary Help Feedback
Cookies Settings




WE CARE ABOUT YOUR PRIVACY

We use cookies to provide you with the best experience on our website, to
improve usability and performance and thereby improve what we offer to you. Our
website may also use third-party cookies to display advertising that is more
relevant to you. If you want to know more about how we use cookies, please see
our Cookie Policy.
Cookies Settings Reject All Accept All Cookies



COOKIE PREFERENCE CENTER




 * GENERAL INFORMATION ON COOKIES


 * STRICTLY NECESSARY


 * PERFORMANCE


 * FUNCTIONAL


 * ADVERTISING

GENERAL INFORMATION ON COOKIES

When you visit our website, we use cookies to ensure that we give you the best
experience. This information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies by clicking on the
different category headings to find out more and change your settings. However,
blocking some types of cookies may impact your experience on the site and the
services we are able to offer. Further information can be found in our
Cookie Policy.

STRICTLY NECESSARY

Always Active

Strictly necessary cookies are always enabled since they are essential for our
website to function. They enable core functionality such as security, network
management, and website accessibility. You can set your browser to block or
alert you about these cookies, but this may affect how the website functions.
For more information please visit www.aboutcookies.org or
www.allaboutcookies.org.

Cookies Details‎

PERFORMANCE

Performance


Performance cookies are used to analyze the user experience to improve our
website by collecting and reporting information on how you use it. They allow us
to know which pages are the most and least popular, see how visitors move around
the site, optimize our website and make it easier to navigate.

Cookies Details‎

FUNCTIONAL

Functional


Functional cookies help us keep track of your past browsing choices so we can
improve usability and customize your experience. These cookies enable the
website to remember your preferred settings, language preferences, location and
other customizable elements such as font or text size. If you do not allow these
cookies, then some or all of these services may not function properly.

Cookies Details‎

ADVERTISING

Advertising


Advertising cookies are used to send you relevant advertising and promotional
information. They may be set through our site by third parties to build a
profile of your interests and show you relevant advertisements on other sites.
These cookies do not directly store personal information, but their function is
based on uniquely identifying your browser and internet device.

Cookies Details‎
Back Button


COOKIE LIST

Filter Button
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Clear
checkbox label label
Apply Cancel
Confirm My Choices
Reject All Allow All

word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word

mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1