SUSE-SU-2023:4227-1

Опубликовано: 27 окт. 2023

Источник: suse-cvrf

Описание

Security update for open-vm-tools

This update for open-vm-tools fixes the following issues:

CVE-2023-34058: Fixed a SAML token signature bypass issue (bsc#1216432).
CVE-2023-34059: Fixed a privilege escalation issue through vmware-user-suid-wrapper (bsc#1216433).

Список пакетов

Container suse/sle-micro-rancher/5.2:latest

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.3:latest

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.4:latest

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Container suse/sle-micro/5.5:latest

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Image SLES15-SP4-CHOST-BYOS-SAP-CCloud

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Image SLES15-SP5-CHOST-BYOS-SAP-CCloud

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

SUSE Enterprise Storage 7.1

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Linux Enterprise Micro 5.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

SUSE Linux Enterprise Micro 5.2

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

SUSE Linux Enterprise Micro 5.3

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

SUSE Linux Enterprise Micro 5.4

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

SUSE Linux Enterprise Micro 5.5

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

SUSE Linux Enterprise Module for Basesystem 15 SP4

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Linux Enterprise Module for Basesystem 15 SP5

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Linux Enterprise Module for Desktop Applications 15 SP4

open-vm-tools-desktop-12.3.0-150300.43.1

SUSE Linux Enterprise Module for Desktop Applications 15 SP5

open-vm-tools-desktop-12.3.0-150300.43.1

SUSE Linux Enterprise Server 15 SP3-LTSS

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Linux Enterprise Server for SAP Applications 15 SP3

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Manager Proxy 4.2

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

SUSE Manager Server 4.2

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

openSUSE Leap 15.4

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

openSUSE Leap 15.5

libvmtools-devel-12.3.0-150300.43.1

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

open-vm-tools-containerinfo-12.3.0-150300.43.1

open-vm-tools-desktop-12.3.0-150300.43.1

open-vm-tools-salt-minion-12.3.0-150300.43.1

open-vm-tools-sdmp-12.3.0-150300.43.1

openSUSE Leap Micro 5.3

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

openSUSE Leap Micro 5.4

libvmtools0-12.3.0-150300.43.1

open-vm-tools-12.3.0-150300.43.1

Ссылки

https://www.suse.com/support/update/announcement/2023/suse-su-20234227-1/
Link for SUSE-SU-2023:4227-1
https://lists.suse.com/pipermail/sle-security-updates/2023-October/016890.html
E-Mail link for SUSE-SU-2023:4227-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1216432
SUSE Bug 1216432
https://bugzilla.suse.com/1216433
SUSE Bug 1216433
https://www.suse.com/security/cve/CVE-2023-34058/
SUSE CVE CVE-2023-34058 page
https://www.suse.com/security/cve/CVE-2023-34059/
SUSE CVE CVE-2023-34059 page

Описание

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

Затронутые продукты

Container suse/sle-micro-rancher/5.2:latest:libvmtools0-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.2:latest:open-vm-tools-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.3:latest:libvmtools0-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.3:latest:open-vm-tools-12.3.0-150300.43.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-34058.html
CVE-2023-34058
https://bugzilla.suse.com/1216432
SUSE Bug 1216432
https://bugzilla.suse.com/1216433
SUSE Bug 1216433
https://bugzilla.suse.com/1228309
SUSE Bug 1228309

Описание

open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.

Затронутые продукты

Container suse/sle-micro-rancher/5.2:latest:libvmtools0-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.2:latest:open-vm-tools-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.3:latest:libvmtools0-12.3.0-150300.43.1

Container suse/sle-micro-rancher/5.3:latest:open-vm-tools-12.3.0-150300.43.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-34059.html
CVE-2023-34059
https://bugzilla.suse.com/1216433
SUSE Bug 1216433
https://bugzilla.suse.com/1225967
SUSE Bug 1225967

SUSE-SU-2023:4227-1

Описание

Список пакетов

Container suse/sle-micro-rancher/5.2:latest

Container suse/sle-micro-rancher/5.3:latest

Container suse/sle-micro-rancher/5.4:latest

Container suse/sle-micro/5.5:latest

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

Image SLES15-SP4-CHOST-BYOS-SAP-CCloud

Image SLES15-SP5-CHOST-BYOS-SAP-CCloud

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

SUSE Linux Enterprise Micro 5.1

SUSE Linux Enterprise Micro 5.2

SUSE Linux Enterprise Micro 5.3

SUSE Linux Enterprise Micro 5.4

SUSE Linux Enterprise Micro 5.5

SUSE Linux Enterprise Module for Basesystem 15 SP4

SUSE Linux Enterprise Module for Basesystem 15 SP5

SUSE Linux Enterprise Module for Desktop Applications 15 SP4

SUSE Linux Enterprise Module for Desktop Applications 15 SP5

SUSE Linux Enterprise Server 15 SP3-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP3

SUSE Manager Proxy 4.2

SUSE Manager Server 4.2

openSUSE Leap 15.4

openSUSE Leap 15.5

openSUSE Leap Micro 5.3

openSUSE Leap Micro 5.4

Ссылки

Уязвимость: CVE-2023-34058

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-34059

Описание

Затронутые продукты

Ссылки