USN-6365-1: Open VM Tools vulnerability

Releases

• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• open-vm-tools - Open VMware Tools for virtual machines hosted on VMware

Details

It was discovered that Open VM Tools incorrectly handled SAML tokens. A
remote attacker could possibly use this issue to bypass SAML token
signature verification and perform VMware Tools Guest Operations.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• open-vm-tools - 2:12.1.5-3ubuntu0.23.04.2

Ubuntu 22.04

• open-vm-tools - 2:12.1.5-3~ubuntu0.22.04.3

Ubuntu 20.04

• open-vm-tools - 2:11.3.0-2ubuntu0~ubuntu20.04.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-20900

Related notices

• USN-6365-2: open-vm-tools-dev, open-vm-tools-desktop, open-vm-tools