Security Bulletin: Vulnerabilities in vCenter affect IBM Cloud Pak System (CVE-2021-21980, CVE-2021-22049 )

Summary

Vulnerabilities have beein found in VMware vCenter. vCenter is shipped with Cloud Pak System. Cloud Pak System has addressed these vulnerabilities.

Vulnerability Details

CVEID:CVE-2021-21980
**DESCRIPTION:**VMware vCenter Server could allow a remote attacker to obtain sensitive information, caused by an unauthorized arbitrary file read vulnerability. By accessing port 443, an attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213975 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-22049
**DESCRIPTION:**VMware vCenter Server is vulnerable to server-side request forgery. By accessing a URL request outside of vCenter Server or accessing an internal service, a remote attacker could exploit this vulnerability to conduct an SSRF attack.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213974 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

For unsupported version/release/platform IBM recommends upgrading to a fixed, supported version of the product.

Vulnerabilities in VMware Vcenter have been found. In response to vulnerability IBM release Cloud Pak System v.3.3.3.5 with new vCenter image update to the latest vCenter 6.7 U3q. The latter is complete fix for vCenter CVE-2021-44228 and CVE-2021-45046. see Security Bulletin: IBM Cloud Pak System is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-45046, CVE-2021-44228).

The recommended solution is to apply the fixpack as soon as possible.

For IBM Cloud Pak System V2.3.0 through to V2.3.3.4 upgrade to V2.3.3.5 at Fix Central

Information on upgrading at : <http://www.ibm.com/support/docview.wss?uid=ibm10887959&gt;

Workarounds and Mitigations

None