Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.3484 VMware vRealize Operations Tenant App update addresses Information Disclosure Vulnerability 20 October 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: VMware vRealize Operations Tenant Publisher: VMware Operating System: Virtualisation VMware ESX Server Impact/Access: Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2021-22034 Original Bulletin: https://www.vmware.com/security/advisories/VMSA-2021-0024.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Moderate Advisory ID: VMSA-2021-0024 CVSSv3 Range: 5.3 Issue Date: 2021-10-19 Updated On: 2021-10-19 CVE(s): CVE-2021-22034 Synopsis: VMware vRealize Operations Tenant App update addresses Information Disclosure Vulnerability (CVE-2021-22034) 1. Impacted Products o VMware vRealize Operations Tenant App for VMware Cloud Director 2. Introduction An information disclosure vulnerability in VMware vRealize Operations Tenant App for VMware Cloud Director was privately reported to VMware. Patch is available to address this vulnerability in impacted VMware products. 3. Information Disclosure Vulnerability in VMware vRealize Operations Tenant App for VMware Cloud Director (CVE-2021-22034) Description The vRealize Operations Tenant App for VMware Cloud Director contains an information disclosure vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3. Known Attack Vectors A malicious actor with network access to port 443 on the vRealize Operations Tenant App may access any set system environment variables, leading to information disclosure. Resolution To remediate CVE-2021-22034 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds None. Additional Documentation None. Acknowledgements VMware would like to thank Dhiraj Shrikant Datar for reporting this vulnerability to us. Notes None. Response Matrix: Product Version Running CVE Identifier CVSSv3 Severity Fixed Workarounds Additional On Version Documentation vRealize Operations 2.x Any CVE-2021-22034 5.3 moderate 8.6 N/A N/A Manager Tenant App 4. References Remediation and Workarounds: vRealize Operations Manager Tenant App 8.6: https://docs.vmware.com/en/Management-Packs-for-vRealize-Operations/8.6/rn /Tenant-App-86-Release-Notes.html FIRST CVSSv3 Calculator: CVE-2021-22034: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/ PR:N/UI:N/S:U/C:L/I:N/A:N (5.3) Mitre CVE Dictionary Links: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22034 5. Change Log 2021-10-19: VMSA-2021-0024 Initial security advisory. 6. Contact E-mail list for product security notifications and announcements: https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce@lists.vmware.com bugtraq@securityfocus.com fulldisclosure@seclists.org E-mail: security@vmware.com - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYW+vEONLKJtyKPYoAQjgPA//UNOZ1uHl6mfOr8smnGEfTOHvQguOvHXx hihfeRf/FUpC8qYz6N6xr1crKe9Dj02KZI4PwE9AEwJa554lfMSjXxqmALPZcwTV k17txFUdGv8ousPxgZIxfzNUrcq65ofO0JvuTAXkMcdMcHXlzOed0vpkDd10w8ah WYeUreAfkn0tB7ySj7xXXsX+DNpuiMC/4byjaVB3girM+vuo23UqpEnKWM+Mi/0r G0RcnS9JcsCHtI/ZRLGpnOZqPxMjXwZjO4MuVcCelis75m8TPGP67Essd2yHRyRt tRiqTnfXRulsr7GyUGU2bR9RggIb/G6sVfFNLiUqdNOcylY4a8Jp4Zgjj8ismcR9 5Ey+mxnNyXyp9PJSOsQTXWPsBKYLHGjTt37FLsCf72nmRqllsVDcQ2UW/VB650Hr WP8eJ7IQkManEuGjqCwGtNVPrbL+HrocBrLBs8AttHyEmXrHP6K9g3JknCxnJc0Y v7zFMTD/5x/yhZA+JgVf1LKkBbdjPqPWK/QzFwJtF2I6geih9OLud6jboFpTqXxX 3wjmzgVg+wzlbqonf16JZYef5TbU/YthvM1waMlwHH/2Zxby08gNBlfuBr+Uxpx4 HvcPimBQ88GxIh1+rePvkEMK3GaiuWLpzlGB0ZR7MpEhpry7PN8GFJsgggfguR2V eM5ENKsoODU= =lp37 -----END PGP SIGNATURE-----