Red Hat Product Errata RHSA-2023:7277 - Security Advisory
Issued:
2023-11-15
Updated:
2023-11-15

RHSA-2023:7277 - Security Advisory

Synopsis

Important: open-vm-tools security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for open-vm-tools is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

  • open-vm-tools: SAML token signature bypass (CVE-2023-34058)
  • open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper (CVE-2023-34059)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2246080 - CVE-2023-34058 open-vm-tools: SAML token signature bypass
  • BZ - 2246096 - CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper

Red Hat Enterprise Linux for x86_64 9

SRPM
open-vm-tools-12.2.5-3.el9_3.2.src.rpm SHA-256: cec1937649c23dc66c66f7cff1c48f7901ca0cd468b5ac078528555bd8204d00
x86_64
open-vm-tools-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 7a8b1e698e031f63cf250d02933fda8dc528141ebc9d8b216d56e5b67188ec18
open-vm-tools-debuginfo-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 62ce35461eafec939dc02abcadf5e4054fbba140faf9b51416d8ae184a3bb3c4
open-vm-tools-debugsource-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 7c5357294bbdf6ab7a36b07351d7ae7eb88e11b0b85fb818b1eff7a5ab26b09d
open-vm-tools-desktop-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 944be41f084af70f41c48da5e3ea6c1d274837a20753faf5146e4e440ff38b0a
open-vm-tools-desktop-debuginfo-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 8f4ac4c347ac14409b5ec821c04dd49b531748f6a9a6362c157cabd6da5c6988
open-vm-tools-salt-minion-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 78cac4d426f92484102da5bac6f7b2b3c572019213d9aa1057cfde187f78c51e
open-vm-tools-sdmp-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: df58b2a9dca6694ee9ac9c1d778a48d8eee1fde301910ffdb837e3847d3a3d93
open-vm-tools-sdmp-debuginfo-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: f8ecf95836e18dd32dc559aafbfd6fe4beebd1caa46e426474c7b5ea97118da5
open-vm-tools-test-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: 627fc225ed6eb22d208267ba46dafe1f6cbaf077174650f8c786ceed1e6d4207
open-vm-tools-test-debuginfo-12.2.5-3.el9_3.2.x86_64.rpm SHA-256: e3fa4c9ec2f0f9c3bcbd91b22caec58f3f600ddbe69181d9c4857cb63ab20a2c

Red Hat Enterprise Linux for ARM 64 9

SRPM
open-vm-tools-12.2.5-3.el9_3.2.src.rpm SHA-256: cec1937649c23dc66c66f7cff1c48f7901ca0cd468b5ac078528555bd8204d00
aarch64
open-vm-tools-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: 717d3fd87ef3e95cd977a891488eedb339695b16ec6cbc5bfd53ff8710a540ba
open-vm-tools-debuginfo-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: 0de56e097fd0b7ed398305750f747021ef08bbefce8ee72dab980eea78ae60a9
open-vm-tools-debugsource-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: f93432b1fffff70eb63acf39d47227e70c0bdceeecd305001fdcb9e766cc1680
open-vm-tools-desktop-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: c922cc5dec779336852ac66e7c4bb28a44fd42f1d68ffa1ec862cc9b6744f9fc
open-vm-tools-desktop-debuginfo-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: 9f55c0f1255d66fc935c0b0c54270c54583f618923e868fb6355ac3bcfd6492f
open-vm-tools-sdmp-debuginfo-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: b5f84ced1ad319b44b45fd5a0bee0899d3c2b8ccadfb21fd1a58f26d07dea38a
open-vm-tools-test-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: b4f0a70112f420dc3e5a2f79cd68b82b9b7d47d91b95f49eae20d47679cdc264
open-vm-tools-test-debuginfo-12.2.5-3.el9_3.2.aarch64.rpm SHA-256: ba00ef7eb304892382e36ea038bc070353264780207884c3713192964a55357e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.