-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: open-vm-tools security update
Advisory ID:       RHSA-2023:5217-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:5217
Issue date:        2023-09-19
CVE Names:         CVE-2023-20900 
=====================================================================

1. Summary:

An update for open-vm-tools is now available for Red Hat Enterprise Linux
7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

The Open Virtual Machine Tools are the open source implementation of the
VMware Tools. They are a set of guest operating system virtualization
components that enhance performance and user experience of virtual
machines.

Security Fix(es):

* open-vm-tools: SAML token signature bypass (CVE-2023-20900)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2236542 - CVE-2023-20900 open-vm-tools: SAML token signature bypass

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
open-vm-tools-11.0.5-3.el7_9.7.src.rpm

x86_64:
open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
open-vm-tools-11.0.5-3.el7_9.7.src.rpm

x86_64:
open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
open-vm-tools-11.0.5-3.el7_9.7.src.rpm

x86_64:
open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

x86_64:
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
open-vm-tools-11.0.5-3.el7_9.7.src.rpm

x86_64:
open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:
open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm
open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-20900
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlCWlmAAoJENzjgjWX9erEPS8P/i8WPrzZQO9inFCO+eay+rbA
VeU/qq1n87Hn0p6M1hGsgiuAHLbZRUDQXamcUIO3bR5UzOv4ZRyYJclDKBtEIlRS
LIZ/ABag717I5GeZsAavy8/xwLWExsteuq/7StmayaCmNpdKukR6ufVrfXD8K7oq
hEIiX/PLEZi8qF+aITUs8naZNOWDwXv3afDXFRXtlB77o/s2hzDnDi1HrqrNmgnA
UpGHUfMvK81EWMgSdpOljYzamEqPUF3sGiz4KyCP3vsF/BQvFRMpYzmcAbAj0rUX
QwZzxf5z9qKcXwgnH/gOPd14lpjxvDSEpgB5DlwkqtIg3FBLYSlTBLoNJPT3RhnC
uOuiMr+jMOUGzutxBYPVqyHWU+Q7o0rT7xzDzz/iyu8fMDrttM0ZRz9wudBwv3iL
r7hVgVMyIqox8jnAMzqmZfyoAHamCleOQxoyTlhHz/RubSO/DlTIuehd2ynIaX1u
YXYoTbUr3yykoLmGufNura5PUbYWOc7C3501vqaJvKSv6k4sCDT4wcEvLu/wjZho
KyaJjJInE2J0MkS89sup9lgJx3AWa7eBdin6iuwPwxn46jx8+xukpzVBfsMZDp10
wkYZzR7bVsVOEcU+xoKIjLib1k3BT9GwKAVeqjstG3lQrG83xY31xCk6c9AHKLVk
/8t3XWkz1U6HaPaNqbYT
=WsFm
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-5217:01 Important: open-vm-tools security update

An update for open-vm-tools is now available for Red Hat Enterprise Linux 7

Summary

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.
Security Fix(es):
* open-vm-tools: SAML token signature bypass (CVE-2023-20900)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2023-20900 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: open-vm-tools-11.0.5-3.el7_9.7.src.rpm
x86_64: open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: open-vm-tools-11.0.5-3.el7_9.7.src.rpm
x86_64: open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: open-vm-tools-11.0.5-3.el7_9.7.src.rpm
x86_64: open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
x86_64: open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: open-vm-tools-11.0.5-3.el7_9.7.src.rpm
x86_64: open-vm-tools-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-desktop-11.0.5-3.el7_9.7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: open-vm-tools-debuginfo-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-devel-11.0.5-3.el7_9.7.x86_64.rpm open-vm-tools-test-11.0.5-3.el7_9.7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2023:5217-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5217
Issued Date: : 2023-09-19
CVE Names: CVE-2023-20900

Topic

An update for open-vm-tools is now available for Red Hat Enterprise Linux7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64


Bugs Fixed

2236542 - CVE-2023-20900 open-vm-tools: SAML token signature bypass


Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo