VMware Critical Vulnerabilities (September 2021)

Deja vu again! New additional Critical severity vulnerabilities have once again been privately reported to VMware.

Unlike previous vulnerabilities identified, only version 6.7 and 7.0 have identified as critical severity, however version 6.5 still has important vulnerabilities that need to be addressed.

This critical vulnerability means that a malicious actor with network access to port 443 on the vCenter server could exploit this to upload a special file to execute code on the vCenter Server.

VMware has offered a workaround for the critical vulnerability CVE-2021-22005, with more details about this in the KB article below:
https://kb.vmware.com/s/article/85717

However due to the temporary nature of the workaround, it is highly recommended to patch to the latest version remediating against the latest vulnerabilities.

The versions below address the identified vulnerabilities:
vCenter Server 7.0 – vCenter Server 7.0 Update 2d (7.0.2.00500), Build number: 18455184
vCenter Server 6.7 – vCenter Appliance 6.7 Update 3o (6.7.0.50000), Build number: 18485166
vCenter Server 6.5 – vCenter Server 6.5 U3q (6.5.0.37000), Build number: 18499837

More details about the advisory and associated versions can be found below:
https://www.vmware.com/security/advisories/VMSA-2021-0020.html

If you are a Perfekt Managed Services customer with VMware management included, then rest assured that by the time you read this the remediation work for your environment has already started or completed.