Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Security update for open-vm-tools and related packages

published 2 years ago

Summary

A security issue affects open-vm-tools, open-vm-tools-debuginfo, open-vm-tools-debugsource and 5 more (Red Hat). The advisory does not describe the issue in detail. Update to 0:11.2.0-2.el8_4.3 or later. See the linked advisory for details.

What to do

Update redhat open-vm-tools to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-debuginfo to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-debugsource to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-desktop to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-desktop-debuginfo to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-sdmp to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-sdmp-debuginfo to version 0:11.2.0-2.el8_4.3.
Update redhat open-vm-tools-test-debuginfo to version 0:11.2.0-2.el8_4.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-debugsource	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-desktop	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-desktop-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-sdmp	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-sdmp-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_aus:8.4::appstream	redhat	open-vm-tools-test-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-debugsource	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-desktop	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-desktop-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-sdmp	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-sdmp-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_e4s:8.4::appstream	redhat	open-vm-tools-test-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-debugsource	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-desktop	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-desktop-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-sdmp	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-sdmp-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3
Red Hat:rhel_tus:8.4::appstream	redhat	open-vm-tools-test-debuginfo	< 0:11.2.0-2.el8_4.3 Fix: upgrade to 0:11.2.0-2.el8_4.3

Original advisory text

Red Hat Security Advisory: open-vm-tools security update

References

https://access.redhat.com/errata/RHSA-2023:5216 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2236542 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5216.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-20900 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-20900 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-20900 Vendor Advisory
https://github.com/vmware/open-vm-tools/blob/CVE-2023-20900.patch/CVE-2023-20900... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.1 High

Timeline

Published16 Sep 2024

Updated1 May 2026

First seen1 May 2026

Sources

RHSA-2023:5216 · OSV

Track software like this

Free during beta