Security scanners flag the system as being vulnerable to CVE-2009-3555 in VMware vRealize Automation 7.x

Products

• VMware Aria Suite

Issue/Introduction

This finding can normally be ignored. The workaround provided in this article will prevent future flagging of this vulnerability on subsequent scans.

Symptoms:

• You are running VMware vRealize Automation 7.x
• Security scanners flag the system as being vulnerable to CVE-2009-3555
  • TLS Protocol Session Renegotiation Security Vulnerability

Resolution

VMware is aware of this issue. See the workaround section below for additional information.

Workaround:

Prerequisites

• Please take simultaneous non-memory snapshots of each virtual appliance(s) in the cluster.

Procedure

1. To prevent future scans from reporting this vulnerability, you may add the following flag in the ssl_options section of the /etc/rabbitmq/rabbitmq.config file:

   {client_renegotiation, false}

For example: Add this between {verify, verify_peer} and {fail_if_no_peer_cert,false} as shown below:

{verify, verify_peer},
{client_renegotiation, false},
{fail_if_no_peer_cert, false}

2. Restart the RabbitMQ server service:

   service rabbitmq-server restart

Note: This should be done on both appliances during a maintenance window as restarting rabbitmq-server can cause unexpected product behavior such as failing requests in flight.

Additional Information

Impact/Risks:
This is not directly exploitable from a remote machine without having the client x509 certificate for the RabbitMQ server.