Описание
Securitys update for open-vm-tools
This update for open-vm-tools fixes the following issues:
Update to 12.3.0 (build 22234872) (bsc#1214850)
-
There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including:
- This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
- A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen.
- Building of the VMware Guest Authentication Service (VGAuth) using 'xml-security-c' and 'xerces-c' is being deprecated.
- A number of Coverity reported issues have been addressed.
- A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes.
- For issues resolved in this release, see the Resolved Issues section of the Release Notes.
-
For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
-
Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
-
The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
-
Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
-
jsc#PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
Список пакетов
Container suse/sle-micro-rancher/5.2:latest
Container suse/sle-micro-rancher/5.3:latest
Container suse/sle-micro-rancher/5.4:latest
Container suse/sle-micro/5.5:latest
Image SLES15-SP3-CHOST-BYOS-SAP-CCloud
Image SLES15-SP4-CHOST-BYOS-SAP-CCloud
Image SLES15-SP5-CHOST-BYOS-SAP-CCloud
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Micro 5.3
SUSE Linux Enterprise Micro 5.4
SUSE Linux Enterprise Module for Basesystem 15 SP4
SUSE Linux Enterprise Module for Basesystem 15 SP5
SUSE Linux Enterprise Module for Desktop Applications 15 SP4
SUSE Linux Enterprise Module for Desktop Applications 15 SP5
SUSE Linux Enterprise Server 15 SP3-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Manager Proxy 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.4
openSUSE Leap 15.5
Ссылки
- Link for SUSE-SU-2023:3835-1
- E-Mail link for SUSE-SU-2023:3835-1
- SUSE Security Ratings
- SUSE Bug 1205927
- SUSE Bug 1214850
- SUSE CVE CVE-2023-20900 page
Описание
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Затронутые продукты
Ссылки
- CVE-2023-20900
- SUSE Bug 1214566
- SUSE Bug 1216432
- SUSE Bug 1216433
- SUSE Bug 1225628
- SUSE Bug 1228309