Lucene search

K
oraclelinuxOracleLinuxELSA-2023-7279
HistoryNov 16, 2023 - 12:00 a.m.

open-vm-tools security update

2023-11-1600:00:00
linux.oracle.com
11
vmware scsi timeout
udev rule
file descriptor vulnerability
saml token signature bypass
cve-2023-34058
cve-2023-34059
rhel-14642
rhel-14676
bz#2226921
orabug: 24461968
22815019
21819156

7.5 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.0%

[11.0.5-3.0.1]

  • fix spaces in vmware udev rule for scsi devices
    [Orabug: 24461968]
  • Fix vmware udev rule in 99-vmware-scsi-timeout.rules file.
    [Orabug: 22815019]
  • Increase timeout for scsi devices on VMWare guests by adding a udev rule.
  • Created a new file 99-vmware-scsi-timeout.rules
  • Modified spec file to install this new file.
    [Orabug: 21819156]
    [11.0.5-3.el7_9.9]
  • ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14642]
  • ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14676]
  • Resolves: RHEL-14642
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-7.9.z])
  • Resolves: RHEL-14676
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-7.9.z])
    [11.0.5-3.el7_9.8]
  • ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [bz#2226921]
  • Resolves: bz#2226921
    ([RHEL7.9][ESXi]Latest version of open-vm-tools breaks VM backups)

7.5 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.0%