Open-vm-tools Security Update: Authentication Bypass Vulnerability
Summary
ALSA-2023:3949: Low: open-vm-tools security update. Affects open-vm-tools versions < 12.1.5-2.el8_8.alma. Fixed in 12.1.5-2.el8_8.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open-vm-tools is the open source implementation of VMware Tools, providing virtualization components that enhance performance and user experience in virtual machines. It is widely used in AlmaLinux 8 ecosystem. However, a security vulnerability has been discovered in the vgauth module of open-vm-tools, which allows for authentication bypass.
Vulnerability Detail
The authentication bypass vulnerability (CVE-2023-20867) in the vgauth module of open-vm-tools can be exploited by an attacker to bypass authentication mechanisms. This could potentially lead to unauthorized access and privilege escalation within virtual machines. The impact of this vulnerability can vary depending on the specific environment and usage of open-vm-tools.
How To Fix
Minimum fixed version
12.1.5-2.el8_8.alma
This is the first release that contains the fix.
sudo dnf update open-vm-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the security update as soon as possible to mitigate the risk.
Conclusion
The authentication bypass vulnerability in the vgauth module of open-vm-tools poses a security risk that can lead to unauthorized access and privilege escalation. It is crucial to update the open-vm-tools package to the latest version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for open-vm-tools →
FAQ
Open-vm-tools is the open source implementation of VMware Tools, providing virtualization components for enhanced performance and user experience in virtual machines.
The vulnerability allows for authentication bypass, potentially leading to unauthorized access and privilege escalation within virtual machines.
To fix this vulnerability, update the open-vm-tools package to version 12.1.5-2.el8_8.alma or later.
No specific workaround has been provided. It is recommended to apply the security update.
More information about this vulnerability can be found in the CVE page: CVE-2023-20867.
Related vulnerabilities
Recent vulnerabilities recorded for open-vm-tools.
