core.vmware.com
Open in
urlscan Pro
18.223.176.167
Public Scan
URL:
https://core.vmware.com/resource/vmsa-2023-0023-questions-answers
Submission: On January 22 via api from TR — Scanned from DE
Submission: On January 22 via api from TR — Scanned from DE
Form analysis
2 forms found in the DOM/search
<form action="/search" id="search-form" class="search-form">
<input type="text" id="filter_keywords" name="search" aria-label="search keywords">
<button class="submit-btn" type="submit" aria-label="Submit">
<svg width="20" height="20">
<use xlink:href="/dist/img/svg-sprite.svg#svg-basic-search"></use>
</svg>
</button>
</form>
<form>
<input class="styled-checkbox-blue" id="directToSignIn" type="checkbox" name="ignore-warning" value="ignore">
<label for="directToSignIn">Check this box to ignore this message in the future.</label>
</form>
Text Content
The Cloud Platform Tech Zone Communities | Customer Connect | VMware.com | Log in Sign in to Tech Zone using your Customer Connect ID * Rate and flag content * Receive recommended reading lists * Enable more powerful searching * Build favorites lists The Tech Zone Family * Apps & Cloud Management * Carbon Black * Cloud Platform * Cross-Cloud Services * Digital Workspace * Networking and Security * VMware Cloud Visit these other VMware sites for additional resources and content. The VMware family * Product Documentation * Support Knowledge Base * Ports & Protocols * TestDrive * Hands-on Labs * Product Downloads * Beta Software Our YouTube channels * vSphere * vSAN * VMware Cloud Foundation Our Twitter feeds * vSphere * vSAN * VMware Cloud Foundation * vSphere Security * VMwareNews RELATED WEBSITES Visit these other VMware sites for additional resources and content. * * * | Communities | Customer Connect | VMware.com Log in * Start * VMware vSphere * VMware Cloud Foundation * Storage and Data Protection VMware vSphere is the leading virtualization platform, enabling organizations to run, manage, and secure applications across cloud and on-premises environments with unmatched agility, scalability, and efficiency. * Latest Content Visit VMware's vSphere technical content page for the latest updates, resources, and documentation on the industry-leading virtualization platform. * vSphere+ Bring the benefits of cloud to on-premises workloads to easily build, run, manage, and secure traditional and next-gen applications. * vSphere VMware vSphere is a powerful virtualization platform that consolidates servers and optimizes resources for scalable and reliable application deployment. * vSphere with Tanzu VMware vSphere with Tanzu enables enterprises to run and manage Kubernetes workloads natively on their virtual infrastructure, simplifying application deployment. * Lifecycle & Patch Management Stay up to date on vSphere patching and updates with resources for planning, preparation, and delivery with VMware's comprehensive lifecycle management tools. * Artificial Intelligence & Machine Learning Enable AI and ML workloads through exceptional GPU support, delivering the necessary performance and scalability for advanced data processing. * Security VMware vSphere security hardening provides in-depth security guides, tools, and best practices to ensure maximum protection for your workloads. * Storage Flexible and fast storage capabilities are central to vSphere, safeguarding VM data while enabling scalability in complex virtualized infrastructures. VMware Cloud Foundation simplifies cloud infrastructure deployment and management, providing a complete set of software-defined services for compute, storage, networking, and security. Streamline IT operations and accelerate your digital transformation with this turnkey solution. * Holodeck Toolkit The VCF Holodeck Toolkit enables easy deployment of comprehensive nested VCF labs and test environments on standalone ESXi hosts. * Cloud Foundation+ VMware Cloud Foundation+ with cloud management capabilities provides hybrid cloud services, simplified licensing, and new administrative and developer tools. * Architecture & Design Visit the VMware Cloud Foundation design and architecture page for resources, best practices, and guidance to plan and deploy your cloud infrastructure. * Deployment & Migration Explore our web page for comprehensive resources on deploying and migrating VMware Cloud Foundation, including interactive demos and installation guides. * Operation & Automation Discover VMware's web page dedicated to resources and documentation for administering and operating VMware Cloud Foundation deployments with ease. * Lifecycle Management Resources on patching and upgrading your VMware Cloud Foundation deployments to gain new features and ensure security and reliability. * Security & Compliance Find security resources for VMware Cloud Foundation deployments, including guides and best practices to help you protect your infrastructure. * Tanzu on Cloud Foundation Discover valuable resources for Kubernetes deployments on VMware Cloud Foundation, including guides, tools, and technical documentation for streamlined operations. VMware provides powerful solutions for storing, protecting, and recovering data in the event of a disaster. Our innovative technologies ensure business continuity and enable organizations to easily manage their storage needs while keeping their data secure. * Cloud Disaster Recovery Protect your data, minimize downtime and reduce costs with optimized disaster recovery (DR) that’s easily accessible on demand and delivered as a SaaS solution. * Cloud Flex Storage Scale storage capacity without adding hosts with VMware Cloud Flex Storage, the flexible, simple and cost-effective way to store and manage your data. * Site Recovery Protect your workloads both on-premises and on VMware Cloud on AWS with VMware Site Recovery – on-demand disaster recovery as-a-service (DRaaS). * Site Recovery Manager Automate orchestration of failover and failback to minimize downtime and improve availability with VMware Site Recovery Manager. * vSAN Reduce storage cost and complexity with VMware vSAN, enterprise-class storage virtualization software that provides the simplest path to hyperconverged infrastructure (HCI) and multi cloud. * Virtual Volumes vVols virtualizes SAN/NAS arrays, enabling a more efficient operational model optimized for virtualized environments and centered on the application instead of the infrastructure. * Solutions * VMware Validated Solutions * AI & Machine Learning * Big Data & Analytics * Business-Critical Applications * Compliance & STIG * Healthcare * Modern Applications * Ransomware Resilience * Security * Storage * VDI * Other Solutions * Blog Advanced Search Past Search History Log in to enable search history. Refine Search by Search Tech ZoneReset FiltersLoad previous filter viewBrowse Tech Zone YOU ARE BEING REDIRECTED TO VMWARE'S CLOUD SERVICES PORTAL (CUSTOMER CONNECT) This message will close in seconds You are about to be redirected to the central VMware login page. Here you can create an account, or login with your existing Customer Connect / Partner Connect / Customer Connect ID. Check this box to ignore this message in the future. Direct me to VMware Sign In Community Liked Not Rated View as PDF Tags More More Share Share Pin Pin Feedback Feedback Toggle Full Screen Asset Information Asset Information Read Time: 0 hr 15 min Creation Date: 1/19/2024 Last Viewed: Login Authors Bob Plankers Read More from the Author Edward Hawkins Read More from the Author Steven Rogerson Read More from the Author Kevin Hagopian Read More from the Author Viviana Miranda Read More from the Author VMSA-2023-0023: QUESTIONS & ANSWERS * Introduction * Current Update * Next Expected Update * Relevant Links * Questions & Answers 1. Who does this affect? 2. When do I need to act? 3. What should I do to protect myself? 4. What products are affected? 5. What CVE numbers are involved in these disclosures? 6. What is the severity of the vulnerabilities disclosed in VMSA-2023-0023? 7. Are there additional details on the vectors of the individual vulnerabilities? 8. Are the vulnerabilities disclosed being exploited “in the wild?” 9. Do I have to patch vCenter Server? 10. Do I have to patch ESXi hosts? 11. Will there be a patch for VMware Cloud Foundation? 12. What versions of vCenter Server are affected? 13. Are there workarounds for these vulnerabilities? 14. What network ports should be restricted as part of a mitigation? 15. What builds are affected by these issues? What version should I move to? 16. How do I check the build number of vCenter Server? 17. If I update vCenter Server will it affect running workloads and virtual machines? 18. Does this impact vSphere 6.x? 19. Will there be a patch to vCenter Server 6.5 or 6.7? 20. Is there any specific guidance for the vCenter Server 6.5 or 6.7 patch? 21. If I apply the vCenter Server 6.5 or 6.7 patch can I receive support for it? 22. Will there be a corresponding ESXi patch release for vSphere 6.5 and 6.7? 23. Can I use the vCenter Server VAMI to apply these updates? 24. Does this impact versions of vSphere older than 6.5? 25. Do I have to update to vSphere 8 Update 2 to receive the patch? 26. Do I have to update to vSphere 7 Update 3 to receive the patch? 27. I am using a third-party solution such as HPE SimpliVity, Dell EMC VxRail, and so on. Is it safe for me to apply the update? 28. Are VMware Cloud and hosted products patched? * Changelog * Disclaimer VMSA-2023-0023: QUESTIONS & ANSWERS INTRODUCTION On October 24, 2023 VMware released a Critical security advisory, VMSA-2023-0023, addressing security vulnerabilities found and resolved in VMware vCenter Server, which is present in VMware vSphere and Cloud Foundation products. The VMSA will always be the source of truth for what products & versions are affected, the workarounds, and proper patches to keep your organization secure. This document is a corollary to the advisory and includes self-service information to help you and your organization decide how to respond. These vulnerabilities are memory management and corruption issues which can be used as a remote code execution attack against VMware vCenter Server services. You are affected by this vulnerability if you are running any version of vSphere except the latest updates for vSphere 6.5, 6.7, 7.0, or 8.0. Please consult the VMSA itself for the definitive list of affected versions. If you have a question about whether you are affected it is likely that you are, and should take action immediately. CURRENT UPDATE Updated at 0800 PST (-0800) on January 19, 2024. NEXT EXPECTED UPDATE There is not a regular update schedule for this document; will be updated as needed. RELEVANT LINKS VMware Security Advisory VMSA-2023-0023 (descriptions of the issues) vSphere Security Configuration & Hardening Guides (the reference for hardening VMware vSphere, virtual machines, and in-guest settings like VMware Tools) VMware Security Advisories (list of all disclosed security vulnerabilities) VMware Security Advisory Mailing List (please subscribe for proactive notifications of security advisories) Best Practices for Patching VMware vSphere (advice for ensuring patching success) Step-by-Step Procedure for Updating vCenter Server using the VAMI (communities.vmware.com) VMware Ports & Protocols & VMware vSphere Firewalling Helper (assistance in determining ingress & egress firewall rule sets) QUESTIONS & ANSWERS WHO DOES THIS AFFECT? Customers who have deployed a product listed in the VMSA (one that includes VMware vCenter Server). Because it affects vCenter Server the scope is large. If you fall under the" you must patch or update your vCenter category", please refer to the VMSA to find the patch respective to your current version. You are affected by this vulnerability if you are running any version of vSphere except the latest updates for vSphere 6.5, 6.7, 7.0, or 8.0. Please consult the VMSA itself for the definitive list of affected versions. If you have a question about whether you are affected it is likely that you are, and should take action immediately. WHEN DO I NEED TO ACT? In ITIL parlance this would be considered an emergency change, and your organization should consider acting quickly. However, all security response depends on context. Please consult with your organization’s information security staff to determine the right course of action for your organization. WHAT SHOULD I DO TO PROTECT MYSELF? To fully protect yourself and your organization, please install one of the patch versions listed in the VMware Security Advisory. Follow the VMware documentation for patching procedures and considerations when using vCenter Server High Availability (not vSphere High Availability). There may be other mitigations available in your organization depending on your security posture, defense-in-depth strategies, and configurations of perimeter firewalls and appliance firewalls. All organizations must decide for themselves whether to rely on those protections. WHAT PRODUCTS ARE AFFECTED? VMware vCenter Server and any products that contain vCenter Server (vSphere and Cloud Foundation, among others). WHAT CVE NUMBERS ARE INVOLVED IN THESE DISCLOSURES? CVE-2023-34048 and CVE-2023-34056 for all versions except 8.0 U1d, which only resolves CVE-2023-34048. WHAT IS THE SEVERITY OF THE VULNERABILITIES DISCLOSED IN VMSA-2023-0023? 9.8 and 4.3. VMware Security Advisories list the severities using version 3.1 of the Common Vulnerability Scoring Standard (CVSS). ARE THERE ADDITIONAL DETAILS ON THE VECTORS OF THE INDIVIDUAL VULNERABILITIES? VMware Security Advisories link to the FIRST CVSS v3.1 calculator, with the vectors pre-filled for the individual vulnerabilities. This information is found in the ‘References’ section of the advisory. ARE THE VULNERABILITIES DISCLOSED BEING EXPLOITED “IN THE WILD?” As of January 18, 2024 VMware is aware of exploitation “in the wild.” Please subscribe to the VMSA mailing list for proactive alerts. DO I HAVE TO PATCH VCENTER SERVER? Yes; vCenter Server is affected by this VMSA. See "Best Practices for Patching VMware vSphere" for guidance on patching vSphere components. DO I HAVE TO PATCH ESXI HOSTS? No; ESXi is not affected by this VMSA. WILL THERE BE A PATCH FOR VMWARE CLOUD FOUNDATION? Yes, there is an asynchronous patch for VMware Cloud Foundation 3.x, 4.x, and 5.x. Please follow the instructions linked in the VMSA itself for patching. WHAT VERSIONS OF VCENTER SERVER ARE AFFECTED? Affected products and product versions are listed in the advisory, as well as the product build numbers which contain the fixes. Please update to those or newer versions. Patch releases are cumulative and newer versions will contain all previous fixes. ARE THERE WORKAROUNDS FOR THESE VULNERABILITIES? There are no workarounds for this advisory that remove the vulnerability. There may be other possible mitigations and compensating controls available in your organization, depending on your security posture, defense-in-depth strategies, and configurations of perimeter firewalls and appliance firewalls. All organizations must decide for themselves whether to rely on those protections, and how to configure those protections effectively for your environment. VMware staff will always advise you to patch, as it is the only way to ensure the removal of the vulnerability. The decision to use other mitigations is something your organization must consider on its own. Similarly, configuration and validation of security controls, such as firewall rules, is an activity that is specific to your environment, and not something that VMware Global Support Services can assist with. For assistance of that nature please contact your account team to enquire about VMware Professional Services. WHAT NETWORK PORTS SHOULD BE RESTRICTED AS PART OF A MITIGATION? VMware strongly recommends strict network perimeter access control to all management components and interfaces in vSphere and related components, such as storage and network components, as part of an overall effective security posture. The specific network ports involved in this vulnerability are 2012/tcp, 2014/tcp, and 2020/tcp. WHAT BUILDS ARE AFFECTED BY THESE ISSUES? WHAT VERSION SHOULD I MOVE TO? You are affected by this vulnerability if you are running any version of vSphere except the very latest updates for vSphere 6.5, 6.7, 7.0, or 8.0 (listed in the VMSA). Please consult the VMSA itself for the definitive list of affected versions. If you have a question about whether you are affected it is likely that you are, and should take action immediately. Path Number What You Are Running You Should Move To... You Can Move To... 1 Release 6.5 U3u or below 7.0 U3o 6.5 U3v Version 6.5.0.41000 7.0.3.01700 6.5.0.42000 Build Number 20510539 22357613 22499743 GA Date October 6, 2022 September 28, 2023 October 24, 2023 2 Release 6.7 U3s or below 7.0 U3o 6.7 U3t 8.0 U1d 8.0 U2 Version 6.7.0.54000 7.0.3.01700 6.7.0.55000 8.0.1.00400 8.0.2.00000 Build Number 20540798 22357613 22509723 22368047 22385739 GA Date October 6, 2022 September 28, 2023 October 24, 2023 October 24, 2023 September 21, 2023 3 Release 7.0 U3n or below 7.0 U3o 8.0 U1d 8.0 U2 Version 7.0.3.01600 7.0.3.01700 8.0.1.00400 8.0.2.00000 Build Number 21958406 22357613 22368047 22385739 GA Date July 7, 2023 September 28, 2023 October 24, 2023 September 21, 2023 4 Release 8.0 U1c or below 8.0 U1d 8.0 U2 Version 8.0.1.00300 8.0.1.00400 8.0.2.00000 Build Number 22088981 22368047 22385739 GA Date July 27. 2023 October 24, 2023 September 21, 2023 5 Release 7.0 U3o No Action Required Version 7.0.3.01700 Build Number 22357613 GA Date September 28, 2023 6 Release 8.0 U2 No Action Required Version 8.0.2.00000 Build Number 22385739 GA Date September 21, 2023 The updates for vCenter Server 6.5 and 6.7 were tested against environments already running 6.5 Update 3 and 6.7 Update 3, respectively. VMware recommends that those deployments be brought to their respective Update 3 prior to applying this update. The recommendation to move to 8.0 U1d is helpful for VMware Cloud Foundation 5.0 customers, as well as to decouple the upgrade process from security remediation work. HOW DO I CHECK THE BUILD NUMBER OF VCENTER SERVER? The build information is available in the Summary tab of the vSphere Client. Alternately it can be queried with PowerCLI. Once connected using Connect-VIServer, build information is available in the $global:DefaultVIServer.Build variable (there is also $global:DefaultVIServer.Version). IF I UPDATE VCENTER SERVER WILL IT AFFECT RUNNING WORKLOADS AND VIRTUAL MACHINES? No. vCenter Server is the management interface to a vSphere cluster. You will lose the use of the vSphere Client briefly during the update, and other management methods will be similarly impacted, but virtual machine and container workloads will be unaffected. DOES THIS IMPACT VSPHERE 6.X? Yes. WILL THERE BE A PATCH TO VCENTER SERVER 6.5 OR 6.7? VMware feels strongly about helping protect customers. Though these products are past their End of General Support dates and nearing the end of their extended support/technical guidance phase, a patch has been developed and is available to all VMware customers. IS THERE ANY SPECIFIC GUIDANCE FOR THE VCENTER SERVER 6.5 OR 6.7 PATCH? The updates for vSphere 6.5/6.7 that are part of this VMSA were tested against environments running VMware vSphere 6.5 Update 3 and VMware vSphere 6.7 Update 3, respectively. VMware recommends that deployments not already at Update 3 be brought to their respective Update 3 prior to applying this update. Given the upcoming end of the vSphere 6.5 and 6.7 product lifecycles, VMware strongly recommends upgrading to vSphere 7 or 8. IF I APPLY THE VCENTER SERVER 6.5 OR 6.7 PATCH CAN I RECEIVE SUPPORT FOR IT? VMware will have heightened support for issues directly related to adoption of all security patches released for VMSA-2023-0023. Issues related to patch adoption will be addressed on a best effort basis until November 14, 2023, after which vSphere 6.5 and 6.7 move to the End of Support Life phase. After that date new support cases cannot be opened for vSphere 6.5 and 6.7. Customers with Extended Support contracts can receive support for vSphere 6.5 and 6.7 through the end of their Extended Support contract, in accordance with the Support Lifecycle Policies found at https://www.vmware.com/support/lifecycle-policies.html and https://lifecycle.vmware.com/. VMware strongly recommends that customers run versions of products that are within the General Support phase of their support lifecycle, such as vSphere 7 and/or 8. WILL THERE BE A CORRESPONDING ESXI PATCH RELEASE FOR VSPHERE 6.5 AND 6.7? No. CAN I USE THE VCENTER SERVER VAMI TO APPLY THESE UPDATES? Yes, the patch will be available through the standard update mechanisms on all vCenter Server versions listed in the VMSA. See "Best Practices for Patching VMware vSphere" for guidance on patching vSphere components. DOES THIS IMPACT VERSIONS OF VSPHERE OLDER THAN 6.5? VMware only analyzes and publishes security advisories for products currently under active general support and strongly recommends that installations be kept current with supported versions. VMware vSphere 6.5 and 6.7 were included in this advisory as an exception, as part of VMware’s commitment to customer security and resilience. Versions of vSphere not listed in the VMSA have not been analyzed and should be assumed to be vulnerable, as with all software which is past the end of support. DO I HAVE TO UPDATE TO VSPHERE 8 UPDATE 2 TO RECEIVE THE PATCH? No. While vSphere 8 Update 2 does contain the fix, there is a patch available to vSphere 8 Update 1 (8.0 U1d) that resolves this, decoupling the upgrade process from the security remediation work. DO I HAVE TO UPDATE TO VSPHERE 7 UPDATE 3 TO RECEIVE THE PATCH? Yes. vSphere 7 Update 3 was released in January 2022 and is considered the best version of vSphere 7, intended for long-term stability and support. New security updates build from vSphere 7 Update 3. I AM USING A THIRD-PARTY SOLUTION SUCH AS HPE SIMPLIVITY, DELL EMC VXRAIL, AND SO ON. IS IT SAFE FOR ME TO APPLY THE UPDATE? Engineered and integrated solutions like HPE SimpliVity and Dell EMC VxRail control their patch levels and configurations as part of their qualification and testing processes. Using security guidance that is not explicitly for that product and product version is never advised. If you use engineered and integrated solutions please contact those vendors directly for guidance. ARE VMWARE CLOUD AND HOSTED PRODUCTS PATCHED? VMware delivers VMSA information as a message inside hosted, cloud, and software-as-a-service products where applicable. In this case no action is necessary by customers for VMware-managed components. Please check the administrative consoles of those services for further relevant messages and details about this VMSA. Additional questions about the service should be answered through the support processes for that service. Thank you. CHANGELOG 2023-10-24, 1930 PDT (-0700): Initial publication. 2023-10-25, 11:50 PDT (-0700): Updates to improve clarity. 2023-10-31, 0930 PDT (-0700): Updates to the VMware Cloud messaging. DISCLAIMER This document is intended to provide general guidance for organizations that are considering VMware solutions. The information contained in this document is for educational and informational purposes only. This document is not intended to provide advice and is provided “AS IS.” VMware makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of the information contained herein. Organizations should engage appropriate legal, business, technical, and audit expertise within their specific organization for review of requirements and effectiveness of implementations. FILTER TAGS Security vSphere Document Security Advisory Comments Company About Us Executive Leadership Newsroom Investor Relations Customer Stories Diversity, Equity & Inclusion Environment, Social & Governance Careers Blogs Communities Acquisitions Office Locations VMware Cloud Trust Center COVID-19 Resources Support VMware Customer Connect Support Policies Product Documentation Compatibility Guide End User Terms & Conditions Twitter YouTube Facebook LinkedIn Contact Sales -------------------------------------------------------------------------------- Copyright © 2005-2024 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Terms of Use Your California Privacy Rights Privacy Accessibility Site Map Trademarks Glossary Help Cookies Settings Modal body text goes here. WE CARE ABOUT YOUR PRIVACY We use cookies to provide you with the best experience on our website, to improve usability and performance and thereby improve what we offer to you. Our website may also use third-party cookies to display advertising that is more relevant to you. If you want to know more about how we use cookies, please see our Cookie Policy. Cookies Settings Reject All Accept All Cookies COOKIE PREFERENCE CENTER * GENERAL INFORMATION ON COOKIES * STRICTLY NECESSARY * PERFORMANCE * FUNCTIONAL * ADVERTISING GENERAL INFORMATION ON COOKIES When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our Cookie Policy. STRICTLY NECESSARY Always Active Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org. Cookies Details PERFORMANCE Performance Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate. Cookies Details FUNCTIONAL Functional Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly. Cookies Details ADVERTISING Advertising Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device. Cookies Details Back Button COOKIE LIST Filter Button Consent Leg.Interest checkbox label label checkbox label label checkbox label label Clear checkbox label label Apply Cancel Confirm My Choices Reject All Allow All