Yesterday VMware released IMPORTANT Security Advisory for vRealize Operations Manager,
Please see below information on VMSA-2021-0018, Important Notes, and Security Patch PAK to address this Security Advisory:
VMSA-2021-0018 – VMware vRealize Operations update addresses multiple security vulnerabilities (CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027) with a maximum CVSSv3 base score of 8.6.
Known Attack Vectors
An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
- vRealize Operations Manager 8.5 is Unaffected
- VMSA-2021-0004 has been updated to reflect this advisory.
- Please be sure to take snapshots of each of the vRealize Operations nodes before applying the Security Patch. See How to take a Snapshot of vRealize Operations (2149269) for more information.
- Download and run the APUAT-18484177.pak attached to the KB Article to run the Pre-Upgrade Readiness Assessment Tool for this Security Patch. Follow vRealize Operations Pre-Upgrade Readiness Assessment Tools (67311) for the latest instructions.
Security Patch PAK – Patch Portal (to address advisory)
- vRealize Operations Manager 8.1.1 – [ Release Name – vROps-8.1.1-HF8 ]
- vRealize Operations Manager 8.2.0 – [ Release Name – vROps-8.2.0-HF7 ]
- vRealize Operations Manager 8.3.0 – [ Release Name – vROps-8.3.0-HF6 ]
- vRealize Operations Manager 8.4.0 – [ Release Name – vROps-8.4.0-HF2 ]
KB Article (to address advisory)
Please like and share to spread the knowledge in the community.
Visit my FB page: https://www.facebook.com/AngrySysOps
Subscribe to my YouTube channel: https://www.youtube.com/channel/UCRTcKGl0neismSRpDMK_M4A