Open-vm-tools SAML Token Signature Bypass
Summary
ALSA-2023:5313: Important: open-vm-tools security update. Affects open-vm-tools versions < 12.1.5-1.el9_2.3.alma.1. Fixed in 12.1.5-1.el9_2.3.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open-vm-tools is the open source implementation of VMware Tools, providing virtualization components for guest operating systems in virtual machines. These tools enhance performance and user experience. However, a vulnerability has been discovered in open-vm-tools that allows for a bypass of SAML token signatures.
Vulnerability Detail
The SAML token signature bypass vulnerability (CVE-2023-20900) in open-vm-tools allows an attacker to bypass the signature verification of SAML tokens. This could lead to unauthorized access, privilege escalation, or other security breaches. The impact of this vulnerability is significant, as it undermines the integrity and security of SAML token-based authentication.
How To Fix
Minimum fixed version
12.1.5-1.el9_2.3.alma.1
This is the first release that contains the fix.
sudo dnf update open-vm-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The SAML token signature bypass vulnerability in open-vm-tools poses a significant security risk. It is crucial to update to the fixed version of open-vm-tools to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for open-vm-tools →
FAQ
Open-vm-tools is the open source implementation of VMware Tools, providing virtualization components for guest operating systems in virtual machines.
A SAML token is an XML-based security token used for authentication and authorization in federated identity systems.
The SAML token signature bypass vulnerability allows an attacker to bypass the signature verification of SAML tokens, potentially leading to unauthorized access or privilege escalation.
The recommended fix is to update open-vm-tools to version 12.1.5-1.el9_2.3.alma.1 or later, which includes patches to address the SAML token signature bypass issue.
More information about this vulnerability can be found in the CVE page for CVE-2023-20900.
Related vulnerabilities
Recent vulnerabilities recorded for open-vm-tools.
