Addressing CVE-2022-31702 and CVE-2022-31703 in vRNI On-Prem installations
search cancel

Addressing CVE-2022-31702 and CVE-2022-31703 in vRNI On-Prem installations

book

Article ID: 312512

calendar_today

Updated On:

Products

VMware Aria Operations for Networks

Issue/Introduction

Multiple vulnerabilities in VMware vRealize Network Insight (vRNI) were privately reported to VMware. Patches and updates are available to remediate these vulnerabilities in vRNI 6.2 / 6.3 / 6.4 / 6.5.1 / 6.6 and 6.7.

CVE-2022-31702 :
vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API.

CVE-2022-31703 :
vRealize Network Insight (vRNI) directory traversal vulnerability in vRNI REST API. 

These vulnerabilities and their impacts on vRNI are documented in the following VMware Security Advisory (VMSA), please review this document before continuing:

Both CVE-2022-31702/CVE-2022-31703 are addressed in vRNI 6.8 and different hot patches are available for 6.2 / 6.3 / 6.4 / 6.5.1 / 6.6 and 6.7 versions.

Environment

VMware vRealize Network Insight 6.2.x
VMware vRealize Network Insight 6.4.0
VMware vRealize Network Insight 6.3.x
VMware vRealize Network Insight 6.5.1
VMware vRealize Network Insight 6.7.0
VMware vRealize Network Insight 6.6.0

Resolution

To mitigate the vulnerability, VMware highly recommends upgrading to vRNI 6.8 that contains the fixes. If upgrading is not possible, below patches are available for vRealize Network Insight version 6.2 / 6.3 / 6.4 / 6.5.1 / 6.6 and 6.7.


Patch Download Details:

Patch for vRealize Network Insight version 6.2.0  

Build Number  1670436787
File Name  VMware-vRNI.6.2.0.P7.1670436787.patch.bundle
Size   650.89 MB
MD5SUM be2ed8ff2611ff5e505db90589c3de47
SHA1SUM 2b08d66756e4ee24056dc098e3bbf590471d7336
SHA256SUM ea598130e4b656a76a7e7288e34660fafc88641eb64408fc95100364dc263d5a



Patch for vRealize Network Insight version 6.3.0

Build Number  1670421532
File Name  VMware-vRNI.6.3.0.P4.1670421532.patch.bundle
Size   671.36 MB
MD5SUM 4551ed9d20a4ef5344244fec1884e211
SHA1SUM 651b2d8aba165b8b53bc06fdb59782a3fc87b0fe
SHA256SUM be64e1b0f5fa1409f72d7b2c549c61530e787cde4f0ccc43d146a5cdca3965ef




Patch for vRealize Network Insight version 6.4.0

Build Number  1670379658
File Name  VMware-vRNI.6.4.0.P8.1670379658.patch.bundle
Size   755.33 MB
MD5SUM 862fc3aee3fe47eb796521db358e6c12
SHA1SUM 274394bfbc58fae114af0abb7a9fdacc4b998ce4
SHA256SUM 66bac8bd0c5fcaaaa1229e8ee8076e20a83ffffa4fd7129932ad866428568ad6




Patch for vRealize Network Insight version 6.5.1

Build Number  1670383888
File Name  VMware-vRNI.6.5.1.P5.1670383888.patch.bundle
Size   685.43 MB
MD5SUM f1e268f790fba4fc0927acbfff0bc105
SHA1SUM 9d835dbcc3a53eec91b4fcb7e95da5f6e5520c9a
SHA256SUM c58c248c496674adb41dbb452449b8fb0b86f1d70a560f3a84870f40e3a2329b




Patch for vRealize Network Insight version 6.6.0

Build Number  1670381875
File Name  VMware-vRNI.6.6.0.P4.1670381875.patch.bundle
Size   649.5 MB
MD5SUM ec84f1489a034eaf77def191d67f6836
SHA1SUM 37ec5b81408cafa39757085fd526c2414b76438c
SHA256SUM a10858330f916dbb80e632d1f8e045b2c29802218568d1902ce2d202756643f6




Patch for vRealize Network Insight version 6.7.0

Build Number  1670340571
File Name  VMware-vRNI.6.7.0.P4.1670340571.patch.bundle
Size   725.12 MB
MD5SUM ba8bb06feace35e24f081f8dd541f378
SHA1SUM 0541d6e0ef0dd2302f3f204d919d0f2553e83114
SHA256SUM f438eb82e8857d245bbf78ecd53c9e5898217630d7bd9db65890b7d6a41652da


Note: Above patches are cumulative of any previous patches for the same version



Procedure to apply vRealize Network Insight patch bundle:

  1. Download the update patch file and save the file on your local system.
  2. Log into the vRealize Network Insight GUI as an Administrator user.

    Note: The default admin@local account can be used.

  3. Navigate to Settings > Install and Support > Overview and Updates, then under Product, select Click here.
  4. Click Browse to select the locally downloaded patch file and click Upload.

    Notes:
     
    • When the upload is complete, vRealize Network Insight shows the Bundle Upload Complete message notification within 2-3 minutes and the bundle processing happens in the background.
    • Until the upload of the package happens, ensure that the session is not closed. If the session ends, you have to restart the upload process.
    • Do not refresh the page after bundle upload, until you see the Update Available message notification.

  5. In the Bundle Available message notification, click View details

    vRealize Network Insight Update screen appears.


  6. Read the Before you proceed instruction and click Continue.
  7. Wait for the pre-checks to complete, which verifies:

    • the disk space, including the space required for migration
    • the version
    • the NTP sync status
    • the bundle checksum

  8. Click Install Now.

    You can see the approximate time required to complete the update process on your setup.

  9. Once the update process begins, the vRealize Network Insight Update screen provides the status of the update process.

    Notes:
    • If a node becomes inactive, the update process does not continue. The update will not resume until the node becomes active again.
    • Once the platforms are updated, you can resume your normal vRealize Network Insight operations even though the collector update happens in parallel. Until the update process is completely over, the Node Version Mismatch detected the message is shown in the Install and Support page.

  10. Upon the completion of the update process, you see the below confirmation message.

    All platform and the collector nodes are updated.

 

Additional Information

For more information about how to download Broadcom products, refer to Download Broadcom products and software

Powered by Wolken Software