jiachao2130/cvrf2cusa
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
d1132d88d2
cvrf2cusa/cvrf/2023/cvrf-openEuler-SA-2023-1629.xml
Jia Chao 0b34274085 git mv 
Signed-off-by: Jia Chao <jiac13@chinaunicom.cn>
2024-07-25 09:57:37 +08:00

145 lines
9.1 KiB
XML
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
<DocumentTitle xml:lang="en">An update for open-vm-tools is now available for openEuler-22.03-LTS</DocumentTitle>
<DocumentType>Security Advisory</DocumentType>
<DocumentPublisher Type="Vendor">
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
<IssuingAuthority>openEuler security committee</IssuingAuthority>
</DocumentPublisher>
<DocumentTracking>
<Identification>
<ID>openEuler-SA-2023-1629</ID>
</Identification>
<Status>Final</Status>
<Version>1.0</Version>
<RevisionHistory>
<Revision>
<Number>1.0</Number>
<Date>2023-09-15</Date>
<Description>Initial</Description>
</Revision>
</RevisionHistory>
<InitialReleaseDate>2023-09-15</InitialReleaseDate>
<CurrentReleaseDate>2023-09-15</CurrentReleaseDate>
<Generator>
<Engine>openEuler SA Tool V1.0</Engine>
<Date>2023-09-15</Date>
</Generator>
</DocumentTracking>
<DocumentNotes>
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">open-vm-tools security update</Note>
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for open-vm-tools is now available for openEuler-22.03-LTS.</Note>
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">The project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of .
Security Fix(es):
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.(CVE-2023-20867)
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .(CVE-2023-20900)</Note>
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for open-vm-tools is now available for openEuler-22.03-LTS.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">open-vm-tools</Note>
</DocumentNotes>
<DocumentReferences>
<Reference Type="Self">
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1629</URL>
</Reference>
<Reference Type="openEuler CVE">
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-20867</URL>
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-20900</URL>
</Reference>
<Reference Type="Other">
<URL>https://nvd.nist.gov/vuln/detail/CVE-2023-20867</URL>
<URL>https://nvd.nist.gov/vuln/detail/CVE-2023-20900</URL>
</Reference>
</DocumentReferences>
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
<Branch Type="Product Name" Name="openEuler">
<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="aarch64">
<FullProductName ProductID="open-vm-tools-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-debuginfo-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-debuginfo-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-devel-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-devel-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-sdmp-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-sdmp-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-test-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-test-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-debugsource-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-debugsource-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-desktop-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-desktop-12.0.5-3.oe2203.aarch64.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="src">
<FullProductName ProductID="open-vm-tools-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-12.0.5-3.oe2203.src.rpm</FullProductName>
</Branch>
<Branch Type="Package Arch" Name="x86_64">
<FullProductName ProductID="open-vm-tools-debugsource-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-debugsource-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-desktop-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-desktop-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-test-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-test-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-salt-minion-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-salt-minion-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-devel-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-devel-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-sdmp-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-sdmp-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
<FullProductName ProductID="open-vm-tools-debuginfo-12.0.5-3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">open-vm-tools-debuginfo-12.0.5-3.oe2203.x86_64.rpm</FullProductName>
</Branch>
</ProductTree>
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.</Note>
</Notes>
<ReleaseDate>2023-09-15</ReleaseDate>
<CVE>CVE-2023-20867</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-22.03-LTS</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>Low</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>3.9</BaseScore>
<Vector>AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>open-vm-tools security update</Description>
<DATE>2023-09-15</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1629</URL>
</Remediation>
</Remediations>
</Vulnerability>
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
<Notes>
<Note Title="Vulnerability Description" Type="General" Ordinal="2" xml:lang="en">A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .</Note>
</Notes>
<ReleaseDate>2023-09-15</ReleaseDate>
<CVE>CVE-2023-20900</CVE>
<ProductStatuses>
<Status Type="Fixed">
<ProductID>openEuler-22.03-LTS</ProductID>
</Status>
</ProductStatuses>
<Threats>
<Threat Type="Impact">
<Description>High</Description>
</Threat>
</Threats>
<CVSSScoreSets>
<ScoreSet>
<BaseScore>7.5</BaseScore>
<Vector>AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</Vector>
</ScoreSet>
</CVSSScoreSets>
<Remediations>
<Remediation Type="Vendor Fix">
<Description>open-vm-tools security update</Description>
<DATE>2023-09-15</DATE>
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1629</URL>
</Remediation>
</Remediations>
</Vulnerability>
</cvrfdoc>
Reference in New Issue View Git Blame Copy Permalink