-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Low: open-vm-tools security update Advisory ID: RHSA-2023:3946-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:3946 Issue date: 2023-06-29 CVE Names: CVE-2023-20867 ===================================================================== 1. Summary: An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream AUS (v.8.4) - x86_64 Red Hat Enterprise Linux AppStream E4S (v.8.4) - x86_64 Red Hat Enterprise Linux AppStream TUS (v.8.4) - x86_64 3. Description: The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: authentication bypass vulnerability in the vgauth module (CVE-2023-20867) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2213087 - CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module 6. Package List: Red Hat Enterprise Linux AppStream AUS (v.8.4): Source: open-vm-tools-11.2.0-2.el8_4.2.src.rpm x86_64: open-vm-tools-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-debugsource-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-desktop-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-sdmp-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-test-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm Red Hat Enterprise Linux AppStream E4S (v.8.4): Source: open-vm-tools-11.2.0-2.el8_4.2.src.rpm x86_64: open-vm-tools-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-debugsource-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-desktop-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-sdmp-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-test-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm Red Hat Enterprise Linux AppStream TUS (v.8.4): Source: open-vm-tools-11.2.0-2.el8_4.2.src.rpm x86_64: open-vm-tools-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-debugsource-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-desktop-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-sdmp-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm open-vm-tools-test-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-20867 https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZJ2oetzjgjWX9erEAQjERQ//bNp2+JTE7SCDT32eGIlv9X5I0wmotK51 UrKrQBwmr5G0In0W7LdZ4mm3CwHxPzI4XZO0Ppod1br57/J9rXp/IJ/hSxsq6zHz wz8kJts5Wjba0zVaaKpXFpv2isEzn12yeViqKlZe4Mw2d9VgoAi/rrNx2Bb+/FRR BPsAQhmIbzvwZe1fOWC5ibpjcEmAEX3Xwb33jENMR4wkFna8fB4SVFxlW9w5LKkc 4vDubNzt/cqmflAIisy1wSC11dXYeLTHEOKK1hf2fIwz7MmFYNLBQnYTitxrgixH ALoJSDMcK5EKvo1QoW94eluaTrJbvqHDjzfIQLvGfXTHs4a/HEfJOfNYlRp9pv/O UsdXcMPN0PZMSpg+BkgK3M00pFDbrLIk9vxT8KqtI4uz+hP60+Rmm40l5iJJN3eQ CMtTLJHLCJaRfCuiYrXY079M/8dp0YxQtsj1+rb5EwloiOmHJ3GxCUTdf36NJYNn yrP++bneFUYGyDiwp6Wy2F45YgPS/vAEzUWawg3rS8NmKhg4ir9lKtmPs3J6RuJ3 fBbQUwOnWObzHk2GKHH3cinEyU/W6AgK2roEKvm+tqw+mYdmKU0HPOSJKi7x+sLz 7pn1ARIw/zEJImnIqAlsrC/y5f8KbQWUJ7szxVG8XV9Eht5MlpfyQ+kb9Lhuf5Bo xv1Q7tNgGQQ= =+k83 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce