REDHAT-BUG-2236542
First published: Thu Aug 31 2023(Updated: )
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the-middle (MITM) network positioning between vCenter server and the virtual machine may be able to bypass SAML token signature verification, to perform VMware Tools Guest Operations. References: <a href="https://www.vmware.com/security/advisories/VMSA-2023-0019.html">https://www.vmware.com/security/advisories/VMSA-2023-0019.html</a> <a href="https://www.openwall.com/lists/oss-security/2023/08/31/1">https://www.openwall.com/lists/oss-security/2023/08/31/1</a> <a href="https://github.com/vmware/open-vm-tools/blob/CVE-2023-20900.patch/CVE-2023-20900.patch">https://github.com/vmware/open-vm-tools/blob/CVE-2023-20900.patch/CVE-2023-20900.patch</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Tools |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.vmware.com/security/advisories/VMSA-2023-0019.html
- https://www.openwall.com/lists/oss-security/2023/08/31/1
- https://github.com/vmware/open-vm-tools/blob/CVE-2023-20900.patch/CVE-2023-20900.patch
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2236578
- https://access.redhat.com/errata/RHSA-2023:5213
- https://access.redhat.com/errata/RHSA-2023:5210
- https://access.redhat.com/errata/RHSA-2023:5216
- https://access.redhat.com/errata/RHSA-2023:5220
- https://access.redhat.com/errata/RHSA-2023:5217
- https://access.redhat.com/errata/RHSA-2023:5218
- https://access.redhat.com/errata/RHSA-2023:5312
- https://access.redhat.com/errata/RHSA-2023:5313
- https://access.redhat.com/errata/RHSA-2024:5315
- https://bugzilla.redhat.com/show_bug.cgi?id=2236542
Frequently Asked Questions
What is the severity of REDHAT-BUG-2236542?
The severity of REDHAT-BUG-2236542 is considered high due to its potential impact on SAML token security.
How do I fix REDHAT-BUG-2236542?
To fix REDHAT-BUG-2236542, users should update VMware Tools to the latest patched version provided by VMware.
What systems are affected by REDHAT-BUG-2236542?
REDHAT-BUG-2236542 affects VMware Tools installed on virtual machines that communicate with a vCenter server.
What type of vulnerability is REDHAT-BUG-2236542?
REDHAT-BUG-2236542 is a SAML token signature bypass vulnerability.
Can exploitation of REDHAT-BUG-2236542 lead to unauthorized access?
Yes, exploitation of REDHAT-BUG-2236542 can allow a malicious actor to perform unauthorized guest operations on virtual machines.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-20900
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/vmware
- canonical/vmware tools