CERTFR-2024-AVI-0585

Vulnerability from certfr_avis - Published: 2024-07-16 - Updated: 2024-07-16

De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
VMware Tanzu VMware Tanzu Application Service for VMs versions 2.11.x antérieures à 2.11.55, versions 2.13.x antérieures à 2.13.37, versions 4.x LTS antérieures à 4.0.20+LTS-T, versions 5.x antérieures à 5.0.10
VMware Tanzu CF Deployment versions antérieures à 30.0.0
VMware Tanzu Operations Manager versions 2.x antérieures à 2.10.71, versions 3.x LTS antérieures à 3.0.25+LTS-T
VMware Tanzu Cflinuxfs4 versions antérieures à 1.83.0
VMware Tanzu Cflinuxfs3 versions antérieures à 0.388.0
VMware Tanzu Isolation Segment versions 2.11.x antérieures à 2.11.49, versions 2.13.x antérieures à 2.13.34, versions 4.x LTS antérieures à 4.0.20+LTS-T, versions 5.x antérieures à 5.0.10
VMware Tanzu Tanzu Greenplum for Kubernetes versions antérieures à 2.0.0
VMware Tanzu Platform Automation Toolkit versions 4.0.x antérieures à 4.0.13, versions 4.1.x antérieures à 4.1.13, versions 4.2.x antérieures à 4.2.8, versions 4.3.x antérieures à 4.3.5, versions 4.4.x antérieures à 4.4.32, versions 5.0.x antérieures à 5.0.25, versions 5.1.x antérieures à 5.1.2
VMware Tanzu Xenial Stemcell versions antérieures à 621.897
VMware Tanzu Jammy Stemcells versions antérieures à 1.486
References
Bulletin de sécurité VMware 24654 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24671 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24679 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24670 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24653 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24665 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24667 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24664 2024-07-12 vendor-advisory
Bulletin de sécurité VMware 24661 2024-07-12 vendor-advisory
Bulletin de sécurité VMware 24669 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24663 2024-07-12 vendor-advisory
Bulletin de sécurité VMware 24655 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24652 2024-07-12 vendor-advisory
Bulletin de sécurité VMware 24656 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24668 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24674 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24681 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24675 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24673 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24666 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24662 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24680 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24676 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24672 2024-07-15 vendor-advisory
Bulletin de sécurité VMware 24657 2024-07-15 vendor-advisory

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Tanzu Application Service for VMs versions 2.11.x ant\u00e9rieures \u00e0 2.11.55, versions 2.13.x ant\u00e9rieures \u00e0 2.13.37, versions 4.x LTS ant\u00e9rieures \u00e0 4.0.20+LTS-T, versions 5.x ant\u00e9rieures \u00e0 5.0.10",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "CF Deployment versions ant\u00e9rieures \u00e0 30.0.0",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Operations Manager versions 2.x ant\u00e9rieures \u00e0 2.10.71, versions 3.x LTS ant\u00e9rieures \u00e0 3.0.25+LTS-T",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cflinuxfs4 versions ant\u00e9rieures \u00e0 1.83.0",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cflinuxfs3 versions ant\u00e9rieures \u00e0 0.388.0",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Isolation Segment versions 2.11.x ant\u00e9rieures \u00e0 2.11.49, versions 2.13.x ant\u00e9rieures \u00e0 2.13.34, versions 4.x LTS ant\u00e9rieures \u00e0 4.0.20+LTS-T, versions 5.x ant\u00e9rieures \u00e0 5.0.10",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Tanzu Greenplum for Kubernetes versions ant\u00e9rieures \u00e0 2.0.0",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Platform Automation Toolkit versions 4.0.x ant\u00e9rieures \u00e0 4.0.13, versions 4.1.x ant\u00e9rieures \u00e0 4.1.13, versions 4.2.x ant\u00e9rieures \u00e0 4.2.8, versions 4.3.x ant\u00e9rieures \u00e0 4.3.5, versions 4.4.x ant\u00e9rieures \u00e0 4.4.32, versions 5.0.x ant\u00e9rieures \u00e0 5.0.25, versions 5.1.x ant\u00e9rieures \u00e0 5.1.2",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Xenial Stemcell versions ant\u00e9rieures \u00e0 621.897",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Jammy Stemcells versions ant\u00e9rieures \u00e0 1.486",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2023-7104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-7104"
    },
    {
      "name": "CVE-2022-2000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2000"
    },
    {
      "name": "CVE-2022-46908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46908"
    },
    {
      "name": "CVE-2023-46218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46218"
    },
    {
      "name": "CVE-2023-28531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28531"
    },
    {
      "name": "CVE-2023-51385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51385"
    },
    {
      "name": "CVE-2023-48237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48237"
    },
    {
      "name": "CVE-2023-48706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48706"
    },
    {
      "name": "CVE-2023-52425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52425"
    },
    {
      "name": "CVE-2024-28757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28757"
    },
    {
      "name": "CVE-2022-1886",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1886"
    },
    {
      "name": "CVE-2023-48235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48235"
    },
    {
      "name": "CVE-2023-48231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48231"
    },
    {
      "name": "CVE-2023-48233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48233"
    },
    {
      "name": "CVE-2023-4813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4813"
    },
    {
      "name": "CVE-2022-2042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2042"
    },
    {
      "name": "CVE-2023-5341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5341"
    },
    {
      "name": "CVE-2023-46219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46219"
    },
    {
      "name": "CVE-2023-5981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5981"
    },
    {
      "name": "CVE-2023-48795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
    },
    {
      "name": "CVE-2022-1897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1897"
    },
    {
      "name": "CVE-2023-6918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6918"
    },
    {
      "name": "CVE-2024-22195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22195"
    },
    {
      "name": "CVE-2023-48236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48236"
    },
    {
      "name": "CVE-2023-5156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5156"
    },
    {
      "name": "CVE-2024-0553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0553"
    },
    {
      "name": "CVE-2023-6237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6237"
    },
    {
      "name": "CVE-2022-1725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1725"
    },
    {
      "name": "CVE-2024-22365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22365"
    },
    {
      "name": "CVE-2024-25062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25062"
    },
    {
      "name": "CVE-2023-50495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50495"
    },
    {
      "name": "CVE-2024-0727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
    },
    {
      "name": "CVE-2023-6129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6129"
    },
    {
      "name": "CVE-2023-4641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4641"
    },
    {
      "name": "CVE-2023-48232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48232"
    },
    {
      "name": "CVE-2023-6004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
    },
    {
      "name": "CVE-2023-48234",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48234"
    },
    {
      "name": "CVE-2023-4806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4806"
    },
    {
      "name": "CVE-2023-46246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46246"
    },
    {
      "name": "CVE-2022-48624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48624"
    },
    {
      "name": "CVE-2023-2953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2953"
    },
    {
      "name": "CVE-2022-1771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1771"
    },
    {
      "name": "CVE-2023-51384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51384"
    },
    {
      "name": "CVE-2021-41617",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41617"
    },
    {
      "name": "CVE-2023-39804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39804"
    },
    {
      "name": "CVE-2020-28493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28493"
    },
    {
      "name": "CVE-2023-5678",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5678"
    },
    {
      "name": "CVE-2024-0567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-0567"
    }
  ],
  "initial_release_date": "2024-07-16T00:00:00",
  "last_revision_date": "2024-07-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0585",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24654",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24654"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24671",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24671"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24679",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24679"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24670",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24670"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24653",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24653"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24665",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24665"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24667",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24667"
    },
    {
      "published_at": "2024-07-12",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24664",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24664"
    },
    {
      "published_at": "2024-07-12",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24661",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24661"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24669",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24669"
    },
    {
      "published_at": "2024-07-12",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24663",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24663"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24655",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24655"
    },
    {
      "published_at": "2024-07-12",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24652",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24652"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24656",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24656"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24668",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24668"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24674",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24674"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24681",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24681"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24675",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24675"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24673",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24673"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24666",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24666"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24662",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24662"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24680",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24680"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24676",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24676"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24672",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24672"
    },
    {
      "published_at": "2024-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24657",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24657"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.