Bugzilla – Bug 1212143
VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module
Last modified: 2023-10-16 18:20:05 UTC
is public https://www.vmware.com/security/advisories/VMSA-2023-0013.html
SUSE-SU-2023:2530-1: An update that solves one vulnerability and has one fix can now be installed. Category: security (moderate) Bug References: 1210695, 1212143 CVE References: CVE-2023-20867 Sources used: SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): open-vm-tools-12.2.0-4.53.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): open-vm-tools-12.2.0-4.53.1 SUSE Linux Enterprise Server 12 SP5 (src): open-vm-tools-12.2.0-4.53.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:2604-1: An update that solves one vulnerability and has one fix can now be installed. Category: security (moderate) Bug References: 1210695, 1212143 CVE References: CVE-2023-20867 Sources used: openSUSE Leap Micro 5.3 (src): open-vm-tools-12.2.0-150300.29.1 openSUSE Leap 15.4 (src): open-vm-tools-12.2.0-150300.29.1 openSUSE Leap 15.5 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro 5.3 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro 5.4 (src): open-vm-tools-12.2.0-150300.29.1 Basesystem Module 15-SP4 (src): open-vm-tools-12.2.0-150300.29.1 Basesystem Module 15-SP5 (src): open-vm-tools-12.2.0-150300.29.1 Desktop Applications Module 15-SP4 (src): open-vm-tools-12.2.0-150300.29.1 Desktop Applications Module 15-SP5 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Real Time 15 SP3 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro 5.1 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro 5.2 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): open-vm-tools-12.2.0-150300.29.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
The patches have been applied and the updated versions of open-vm-tools are available in the update channels. Marking as fixed.
This CVE also affects sles15sp3ltss, when will related patches be released?
(In reply to liu yu from comment #10) > This CVE also affects sles15sp3ltss, when will related patches be released? Or I currently install the version of sles15sp4, is it feasible?
@liu it does not seem like this issue's severity qualifies for proactive LTSS security, and general support has ended. Am I missing something? Thanks, C
(In reply to Claudio Fontana from comment #12) > @liu it does not seem like this issue's severity qualifies for proactive > LTSS security, and general support has ended. Am I missing something? > > Thanks, > > C Thanks Reply.
SUSE-SU-2023:3505-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1212143, 1214566 CVE References: CVE-2023-20867, CVE-2023-20900 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): open-vm-tools-11.3.5-150200.5.16.16.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): open-vm-tools-11.3.5-150200.5.16.16.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): open-vm-tools-11.3.5-150200.5.16.16.1 SUSE Enterprise Storage 7 (src): open-vm-tools-11.3.5-150200.5.16.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3504-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1212143, 1214566 CVE References: CVE-2023-20867, CVE-2023-20900 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): open-vm-tools-11.3.5-150100.4.37.18.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): open-vm-tools-11.3.5-150100.4.37.18.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): open-vm-tools-11.3.5-150100.4.37.18.1 SUSE CaaS Platform 4.0 (src): open-vm-tools-11.3.5-150100.4.37.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:2604-2: An update that solves one vulnerability and has one security fix can now be installed. Category: security (moderate) Bug References: 1210695, 1212143 CVE References: CVE-2023-20867 Sources used: SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Manager Proxy 4.2 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Manager Retail Branch Server 4.2 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Manager Server 4.2 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Enterprise Storage 7.1 (src): open-vm-tools-12.2.0-150300.29.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): open-vm-tools-12.2.0-150300.29.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
we have meanwhile also released updates for LTSS.