core.vmware.com Open in urlscan Pro
3.130.210.188  Public Scan

Form analysis
2 forms found in the DOM

/search

<form action="/search" id="search-form" class="search-form">
  <input type="text" id="filter_keywords" name="search" aria-label="search keywords">
  <button class="submit-btn" type="submit" aria-label="Submit">
    <svg width="20" height="20">
      <use xlink:href="/dist/img/svg-sprite.svg#svg-basic-search"></use>
    </svg>
  </button>
</form>

<form>
  <input class="styled-checkbox" id="directToSignIn" type="checkbox" name="ignore-warning" value="ignore">
  <label for="directToSignIn">Check this box to ignore this message in the future.</label>
</form>

Text Content

The Cloud Platform Tech Zone


RELATED WEBSITES

Visit these other VMware sites for additional resources and content.

The VMware family
 * Product Documentation
 * Support Knowledge Base
 * Ports & Protocols
 * TestDrive
 * Hands-on Labs
 * Product Downloads
 * Beta Software

Our YouTube channels
 * vSphere
 * vSAN
 * VMware Cloud Foundation

Our Twitter feeds
 * vSphere
 * vSAN
 * VMware Cloud Foundation
 * vSphere Security
 * VMwareNews

Communities | Customer Connect | VMware.com |
Log in

Sign in to Tech Zone using your Customer Connect ID

 * Rate and flag content
 * Receive recommended reading lists
 * Enable more powerful searching
 * Build favorites lists


RELATED WEBSITES

Visit these other VMware sites for additional resources and content.

 * 
 * 
 * 

| Communities | Customer Connect | VMware.com
Log in
 * Products
   * VMware Cloud Disaster Recovery
   * VMware Cloud Flex Storage
   * VMware Cloud Foundation
   * VMware Validated Solutions
   * VMware Site Recovery
   * VMware Site Recovery Manager
   * VMware vSAN
   * VMware vSphere
   * VMware vCenter Server
   * VMware vSphere Bitfusion
   * VMware vSphere with Tanzu
   * VMware vSphere Virtual Volumes
 * Solutions
   * AI & Machine Learning
   * Big Data & Analytics
   * Business-Critical Applications
   * Compliance
   * Disaster Recovery
   * Healthcare
   * Modern Applications
   * Operations Management
   * Ransomware Resilience
   * Security
   * Storage
   * VDI
   * Other Solutions
 * Blog

Advanced Search

Refine Search by

Search Tech ZoneReset FiltersLoad previous filter viewBrowse Tech Zone

YOU ARE BEING REDIRECTED TO VMWARE'S CLOUD SERVICES PORTAL (CUSTOMER CONNECT)

This message will close in seconds
You are about to be redirected to the central VMware login page. Here you can
create an account, or login with your existing Customer Connect / Partner
Connect / Customer Connect ID.
Check this box to ignore this message in the future.
Direct me to VMware Sign In

Not Rated

View as PDF
Tags

Tags

More
Share

Share
Pin

Pin
Feedback

Feedback

Toggle Full Screen



VMSA-2022-0011: QUESTIONS & ANSWERS

 * Introduction
 * Next Expected Update
 * Resources
 * Questions & Answers
   1.  Who is affected?
   2.  When do I need to act?
   3.  What should I do to protect myself?
   4.  Can I just firewall the affected products instead of patching or using
       the workaround?
   5.  Is this being exploited "in the wild?"
   6.  How were the issues discovered?
   7.  Is VMware Cloud on AWS affected?
   8.  Are hosted VMware Workspace ONE services affected?
   9.  Are Carbon Black Cloud services affected?
   10. It looks like VMware did maintenance on cloud services. How can I see the
       status of those services and upcoming maintenance activities?
   11. I have extended support on an affected product. How can I get a patch for
       this?
   12. Are there any downsides to using the workaround?
   13. Is this a vulnerability in vSphere?
   14. Do I have to patch ESXi hosts?
   15. Will there be a patch for VMware Cloud Foundation?
   16. What are the CVE numbers involved in VMSA-2022-0011?
   17. I am using a third-party solution, like Dell EMC VxRail, HPE SimpliVity,
       and so on. Is it safe for me to apply either the workarounds or the
       patch?
   18. I have feedback about the products and/or processes. How do I provide it
       to you?
   19. Is VMware doing anything about these security issues?
   20. Is this related to the Spring4Shell vulnerabilities?
 * Change Log


VMSA-2022-0011: QUESTIONS & ANSWERS


INTRODUCTION

On April 6, 2022 VMware released VMSA-2022-0011, a critical advisory addressing
security vulnerabilities found and resolved in VMware’s Workspace ONE Access,
VMware Identity Manager (vIDM), vRealize Lifecycle Manager, vRealize Automation,
and VMware Cloud Foundation products. VMware Identity Manager is also an
optional external component that can provide authentication and authorization
for other products, such as NSX, vRealize Operations, vRealize Log Insight, and
vRealize Network Insight. The VMSA will always be the source of truth for what
products & versions are affected, the workarounds, and appropriate patches. This
document is a corollary to that advisory and contains resources and numerous
questions & answers that have been asked regarding this issue in an effort to
communicate new information, reduce the need for support calls, and help keep
organizations secure.


NEXT EXPECTED UPDATE

There will not be a regular update schedule for this document.


RESOURCES

Links to the different resources available:

 * VMware Security Advisory VMSA-2022-0011 (descriptions of the issues and
   workarounds)

 * Frequently Asked Questions for VMSA-2022-0011 (this document)

 * Tips for Patching VMware vSphere (practical advice for ensuring patching
   success)

 * VMware vSphere Security Configuration Guide (baseline security best practices
   for vSphere)
 * VMware Ransomware Resource Center (discussion around tactics to help prevent,
   deter, and recover from attacks)
 * VMware Ports & Protocols Firewalling Guidance (ports.vmware.com)


QUESTIONS & ANSWERS

We add new questions and answers to the end of this document to preserve links
into the subsections here. Please use the index on the left side to scan the
questions -- the question you have might be near the end!


WHO IS AFFECTED?

Customers who have deployed a product listed in the VMSA. Please note that this
might include product & suites that offer VMware Identity Manager (vIDM)
components as an optional installation.


WHEN DO I NEED TO ACT?

This critical vulnerability should be patched or mitigated immediately per the
instructions in VMSA-2021-0011. The ramifications of this vulnerability are
serious.

Organizations that practice change management using the ITIL definitions of
change types would consider this an “emergency change.” All environments are
different, have different tolerance for risk, and have different security
controls and defense-in-depth to mitigate risk, so customers must make their own
decisions on how to proceed. However, given the severity of the vulnerability,
we strongly recommend immediate action. 


WHAT SHOULD I DO TO PROTECT MYSELF?

To fully protect yourself and your organization please install one of the patch
versions listed in the VMware Security Advisory, or use the workarounds listed
in the VMSA.

There may be other protections available in your organization, depending on your
security posture, defense-in-depth strategies, and configurations of virtual
machines. All organizations must decide for themselves whether to rely on those
protections.


CAN I JUST FIREWALL THE AFFECTED PRODUCTS INSTEAD OF PATCHING OR USING THE
WORKAROUND?

All organizations have different environments and needs. Whether firewalls are
appropriate compensating controls in your environment for this particular
situation is for customers and their information security staff to assess.


IS THIS BEING EXPLOITED "IN THE WILD?"

Yes. VMware has confirmed that exploitation of CVE-2022-22954 has occurred in
the wild.


HOW WERE THE ISSUES DISCOVERED?

As specified in our security advisory: 

"VMware would like to thank Steven Seeley (mr_me) of Qihoo 360 Vulnerability
Research Institute for reporting this issue to us."


IS VMWARE CLOUD ON AWS AFFECTED?

No.


ARE HOSTED VMWARE WORKSPACE ONE SERVICES AFFECTED?

All issues related to VMSA-2022-0011 have been resolved in hosted Workspace ONE
services via code deployment.


ARE CARBON BLACK CLOUD SERVICES AFFECTED?

No.


IT LOOKS LIKE VMWARE DID MAINTENANCE ON CLOUD SERVICES. HOW CAN I SEE THE STATUS
OF THOSE SERVICES AND UPCOMING MAINTENANCE ACTIVITIES?

https://status.vmware-services.io/ is the status dashboard for VMware Cloud on
AWS, which also encompasses many other cloud-based services.

https://status.workspaceone.com/ is the status dashboard for VMware Workspace
ONE.

https://status.carbonblack.com/ is the status dashboard for VMware Carbon Black
tools & services.


I HAVE EXTENDED SUPPORT ON AN AFFECTED PRODUCT. HOW CAN I GET A PATCH FOR THIS?

Please follow the extended support process to request patches and other
information.


ARE THERE ANY DOWNSIDES TO USING THE WORKAROUND?

The only way to remove the vulnerabilities from your environment is to apply
patches provided in VMSA-2021-0011. Workarounds, while convenient, do not remove
the vulnerabilities, and may introduce additional complexities that patching
would not.

While the decision to patch or use the workaround is yours, VMware always
strongly recommends patching as the simplest and most reliable way to resolve
this issue.


IS THIS A VULNERABILITY IN VSPHERE?

No, but please consult VMSA-2022-0011 for the list of affected products so you
can confirm whether any of them are currently in use in your environment.


DO I HAVE TO PATCH ESXI HOSTS?

ESXi is not affected by this VMSA.


WILL THERE BE A PATCH FOR VMWARE CLOUD FOUNDATION?

Yes. Please follow the instructions linked in the VMSA itself for patching
and/or a workaround.


WHAT ARE THE CVE NUMBERS INVOLVED IN VMSA-2022-0011?

CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958,
CVE-2022-22959, CVE-2022-22960, CVE-2022-22961


I AM USING A THIRD-PARTY SOLUTION, LIKE DELL EMC VXRAIL, HPE SIMPLIVITY, AND SO
ON. IS IT SAFE FOR ME TO APPLY EITHER THE WORKAROUNDS OR THE PATCH?

VMware is proud of the robust partner ecosystem and community built around our
products, but we cannot speak to our partners’ solutions. Nor would they want us
to.

Engineered and integrated solutions like Dell EMC VxRail, HPE SimpliVity, and
even VMware Cloud Foundation control their patch levels and configurations as
part of their qualification and testing processes. Using security guidance that
is not explicitly for that product and product version is never advised. VMware
covers VMware Cloud Foundation in our security advisory materials, but if you
have additional engineered and integrated solutions in play, you should contact
those vendors directly for guidance.


I HAVE FEEDBACK ABOUT THE PRODUCTS AND/OR PROCESSES. HOW DO I PROVIDE IT TO YOU?

VMware appreciates any and all feedback on our products and processes. Please
contact your Account Executive, Solutions Engineer, or Technical Account
Manager. They have processes for submitting feedback on your behalf.

Please help us help you – many features and improvements have been realized
because of suggestions made by customers. If we can make life better for you
please tell us how.


IS VMWARE DOING ANYTHING ABOUT THESE SECURITY ISSUES?

Our product teams always investigate the full impact of a vulnerability on both
our products and our environment in order to protect our customers, partners and
stakeholders.


IS THIS RELATED TO THE SPRING4SHELL VULNERABILITIES?

No. Those are covered exclusively in VMSA-2022-0010.


CHANGE LOG

2022-04-12, 0745: Updated the answer to "is this being used in the wild?"

2022-04-06, 1023: Updated the "Will there be a patch for VMware Cloud
Foundation?" answer to refer to the VMSA itself.

2022-04-06: 0800: Initial release.

FILTER TAGS

Security Cloud Foundation Cloud Foundation 3.9 Cloud Foundation 4 Cloud
Foundation 4.2 Cloud Foundation 4.2.1 Cloud Foundation 4.3 Cloud Foundation
4.3.1 Document

Comments

Company

About Us Executive Leadership Newsroom Investor Relations Customer Stories
Diversity, Equity & Inclusion Environment, Social & Governance
Careers Blogs Communities Acquisitions Office Locations VMware Cloud Trust
Center COVID-19 Resources

Support

VMware Customer Connect Support Policies Product Documentation Compatibility
Guide End User Terms & Conditions
Twitter YouTube Facebook LinkedIn Contact Sales

--------------------------------------------------------------------------------

© 2022 VMware, Inc. Terms of Use Your California Privacy Rights Privacy
Accessibility Site Map Trademarks Glossary Help Feedback Cookie Settings

Modal body text goes here.



We use cookies to provide you with the best experience on our website, to
improve usability and performance and thereby improve what we offer to you. Our
website may also use third-party cookies to display advertising that is more
relevant to you. By clicking on the “Accept All” button you agree to the storing
of cookies on your device. If you want to know more about how we use cookies,
please see our Cookie Policy.

Cookie Settings Accept All Cookies



COOKIE PREFERENCE CENTER




GENERAL INFORMATION ON COOKIES

GENERAL INFORMATION ON COOKIES

When you visit our website, we use cookies to ensure that we give you the best
experience. This information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies by clicking on the
different category headings to find out more and change your settings. However,
blocking some types of cookies may impact your experience on the site and the
services we are able to offer. Further information can be found in our
Cookie Policy.


 * STRICTLY NECESSARY
   
   STRICTLY NECESSARY
   
   Always Active
   Strictly Necessary
   
   Strictly necessary cookies are always enabled since they are essential for
   our website to function. They enable core functionality such as security,
   network management, and website accessibility. You can set your browser to
   block or alert you about these cookies, but this may affect how the website
   functions. For more information please visit www.aboutcookies.org or
   www.allaboutcookies.org.
   
   Cookie Details‎


 * PERFORMANCE
   
   PERFORMANCE
   
   Performance
   
   Performance cookies are used to analyze the user experience to improve our
   website by collecting and reporting information on how you use it. They allow
   us to know which pages are the most and least popular, see how visitors move
   around the site, optimize our website and make it easier to navigate.
   
   Cookie Details‎
   
   
   PLEASE CONFIRM YOUR SETTINGS BY REFRESHING THE PAGE.


 * FUNCTIONAL
   
   FUNCTIONAL
   
   Functional
   
   Functional cookies help us keep track of your past browsing choices so we can
   improve usability and customize your experience. These cookies enable the
   website to remember your preferred settings, language preferences, location
   and other customizable elements such as font or text size. If you do not
   allow these cookies, then some or all of these services may not function
   properly.
   
   Cookie Details‎
   
   
   PLEASE CONFIRM YOUR SETTINGS BY REFRESHING THE PAGE.


 * ADVERTISING
   
   ADVERTISING
   
   Advertising
   
   Advertising cookies are used to send you relevant advertising and promotional
   information. They may be set through our site by third parties to build a
   profile of your interests and show you relevant advertisements on other
   sites. These cookies do not directly store personal information, but their
   function is based on uniquely identifying your browser and internet device.
   
   Cookie Details‎
   
   
   PLEASE CONFIRM YOUR SETTINGS BY REFRESHING THE PAGE.


 * SOCIAL MEDIA
   
   SOCIAL MEDIA
   
   Social Media
   
   Social media cookies are intended to facilitate the sharing of content and to
   improve the user experience. These cookies can sometimes track your
   activities. We do not control social media cookies and they do not allow us
   to gain access to your social media accounts. Please refer to the relevant
   social media platform’s privacy policies for more information.
   
   Cookie Details‎
   
   
   PLEASE CONFIRM YOUR SETTINGS BY REFRESHING THE PAGE.

Back Button


ADVERTISING COOKIES

Filter Button
Consent Leg.Interest
Select All Vendors
Select All Vendors
Select All Hosts

Select All

 * REPLACE-WITH-DYANMIC-HOST-ID
   
   
   
   View Third Party Cookies
   
    * Name
      cookie name



Clear Filters

Information storage and access
Apply
Confirm My Choices Allow All