Guidelines to address multiple security vulnerabilities for VCF 3.10.x, VCF 3.11.x, VCF 4.3.x, VCF 4.4.x and VCF 4.5 releases by VMSA-2022-0030 and VMSA-2022-0033

Products

• VMware Cloud Foundation

Issue/Introduction

VMSA-2022-0030  details vulnerabilities in vCenter Server 6.7 & 7.0 and VMware ESXi 6.7 & 7.0. These vulnerabilities are remediated in the releases vCenter Server 7.0 Update 3i and ESXi 7.0 Update 3i.
These issues have also been fixed in vCenter Server 6.7 Update 3s and VMware ESXi 6.7, Patch Release ESXi670-202210001.

VMSA-2022-0033 details vulnerabilities in VMware ESXi 7.0. These are remediated in VMware ESXi 7.0 Update 3i 

This KB documents the process should customers running VMware Cloud Foundation 3.10.x, 3.11.x or 4.x wish to update their vCenter Server and ESXi hosts.

Symptoms:
As documented in VMSA-2022-0030, vCenter Server 6.7 & 7.0 and Vmware ESXi 6.7 & 7.0 is affected by the vulnerabilities listed in the advisories.

As documented in VMSA-2022-0033, VMware ESXi 7.0 is affected by the vulnerabilities listed in the advisories.

Since the VMware Cloud Foundation (VCF) 3.10.x, 3.11.x and 4.x versions bundle the impacted releases of vCenter Server and VMware ESXi ; VCF 3.10.x, 3.11.x and VCF 4.x releases are similarly impacted by the vulnerabilities listed in the advisory.
 

 

Environment

VMware Cloud Foundation 4.4.x
VMware Cloud Foundation 3.0.x
Vmware Cloud Foundation 4.5
VMware Cloud Foundation 4.3.x

Resolution

The vCenter Server 7.0 Update 3i and ESXi 7.0 Update 3i releases are available on VCF Async Patch Tool for the VCF customers to readily upgrade their vCenter Server and ESXi hosts. Please follow the table below for further guidance :

 

VCF Release	Resolution
VCF 3.10.x and 3.11.x	Refer KB389764 to Async Patch VMware ESXi 6.7, Patch Release ESXi670-202210001
Prior to VCF 4.3.1.1	Upgrade to VCF 4.3.1.1 or above and refer KB 88287
VCF 4.3.1.1	Refer KB 88287
VCF 4.4	Refer KB 88287
VCF 4.4.1	Refer KB 88287
VCF 4.4.1.1	Refer KB 88287
VCF 4.5	Refer KB 88287