VMware Aria Operations for Logs (formerly vRealize Log Insight)

Multiple vulnerabilities in VMware Aria Operations for Logs were privately reported to VMware. Updates and workarounds are available to address these vulnerabilities in affected VMware products.

An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.

To remediate CVE-2023-20864 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below.

None.

None.

VMware has confirmed that exploit code for CVE-2023-20864 has been published.

VMware would like to thank Anonymous working with Trend Micro Zero Day Initiative for reporting this issue to us.

VMware Aria Operations for Logs contains a command injection vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.

A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.

To remediate CVE-2023-20865 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below.

None.

None.

None.

VMware would like to thank Y4er & MoonBack of 埃文科技 for reporting this vulnerability to us.

Fixed Version(s) and Release Notes:

VMware Aria Operations for Logs (Operations for Logs) 8.12 Release Notes

Downloads and Documentation:

https://customerconnect.vmware.com/en/downloads/info/slug/infrastructure_operations_management/vmware_aria_operations_for_logs/8_12

https://docs.vmware.com/en/VMware-Aria-Operations-for-Logs/8.12/rn/vmware-aria-operations-for-logs-812-release-notes/index.html

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20864

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20865

FIRST CVSSv3 Calculator:

CVE-2023-20864:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2023-20865:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

2023-04-20 VMSA-2023-0007

Initial security advisory.

2023-07-10 VMSA-2023-0007.1

Updated VMSA to note that VMware has confirmed that exploit code for CVE-2023-20864 has been published.

E-mail: [email protected]

PGP key at:

https://kb.vmware.com/kb/1055

VMware Security Advisories

http://www.vmware.com/security/advisories

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html

VMware Security & Compliance Blog

https://blogs.vmware.com/security

Twitter

https://twitter.com/VMwareSRC

Copyright 2023 VMware Inc. All rights reserved.