Open-vm-tools Security Update
Summary
ALSA-2023:3948: Low: open-vm-tools security update. Affects open-vm-tools versions < 12.1.5-1.el9_2.1.alma. Fixed in 12.1.5-1.el9_2.1.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open-vm-tools is the open source implementation of VMware Tools, providing virtualization components for guest operating systems in virtual machines. These tools enhance performance and user experience. The package is vulnerable to an authentication bypass vulnerability in the vgauth module.
Vulnerability Detail
The vulnerability in the vgauth module of open-vm-tools allows for authentication bypass. This could potentially lead to unauthorized access and compromise of virtual machines. The impact of this vulnerability is significant, as it undermines the security measures in place for authentication.
How To Fix
Minimum fixed version
12.1.5-1.el9_2.1.alma
This is the first release that contains the fix.
sudo dnf update open-vm-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the open-vm-tools package to the fixed version.
Conclusion
The open-vm-tools package is vulnerable to an authentication bypass vulnerability. It is crucial to update the package to the fixed version to mitigate the risk of unauthorized access and compromise of virtual machines. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for open-vm-tools →
FAQ
Open-vm-tools is the open source implementation of VMware Tools, providing virtualization components for guest operating systems in virtual machines.
The vulnerability allows for authentication bypass, potentially leading to unauthorized access and compromise of virtual machines.
To fix this vulnerability, update the open-vm-tools package to version 12.1.5-1.el9_2.1.alma or later.
There is no known workaround. Updating the open-vm-tools package is the recommended solution.
For more details about this vulnerability, refer to the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for open-vm-tools.
