This article covers the fixes made in VMware Aria Operations 8.14 from previous versions.
Important notice regarding Remote Collectors:
Cloud proxies have been established as a long-term solution for data collection. In future releases, the introduction of new features will be exclusively limited to cloud proxies, if relevant. The announcement regarding the expiration of support for Remote Collectors and the prohibition of deploying new remote Collectors has already been added in the previous 8.10 Release notes and accompanying documentation.
VMware Aria Operations 8.14 will be the last release to provide support for Remote Collectors. In the next on-premises release, upgrades will not be allowed if there are Remote Collectors in use. To upgrade to the next version or a later one, it is imperative to replace all Remote Collectors with cloud proxies.
As a recommendation, the following steps are proposed:
- If you are using a collector group, add new cloud proxies to it and remove the Remote Collectors.
- If you are not already using a collector group, create a new collector group and deploy cloud proxies into it. Reassign all adapter instances that were previously associated with Remote Collectors to the collector groups and remove the Remote Collectors.
The following issues have been resolved as of vRealize Operations 8.14:
- [SNow plugin] vrops-generic-rest-plugin should support proxy for HTTPS.
- [Scheduled Automation] Possibility to import VMs from custom group in Automation Central.
- Disabling the demand model metrics along with allocation model metrics from policy needs to be handled from cost engine/analytics.
- [Configuration Files] Getting error message when login with Read Only user.
- [VMware Infrastructure Health MP] Confusing message is displayed when testing adapter instance connection.
- Empty text on the header search box is confusing.
- Defined By remains "System" after upgrade for some custom groups.
- Slow vpostgres-repl service startup on replica node.
- A Region per account object does not become "not existing" when there is no service under the object.
- Getting null pointer exceptions in the admin UI logs.
- [Metric Search in Global Search] "No data to display" issue in the described case.
- [VCF Health] Size of the checkmarks is different for each card.
- Inconsistent paddings for grid Actions and Filter items in several pages of the product.
- Inconsistency of action menu items, ordering and rules for single and bulk actions in several pages of the product.
- Date range picker warning block update.
- Alerts banner issue on the Launchpad page in the described case.
- [Rebranding] Product name is incorrect in the ssh banner after upgrading the setup.
- [Rebranding] Product name is incorrect in the ssh banner of the Cloud proxy.
- Redundant GCP API calls for fetching region metadata should be eliminated from GCP MP.
- Invalid Regular Expression validation error message thrown in UI when trying to save an OOTB Symptom definition.
- New generic component for all "standard alert" banners.
- [VCF Health] Issues with "VCF Operations Page" permission.
- [Metric Search] there is a significant delay and a non responsive UI when viewing Metric Search results for the first time.
- [Launchpad] "VIEW" button on widgets in the "Launchpad" page is not disabled and navigate to the "Launchpad" tub.
- Unnecessary modules and icons cleanup.
- Incorrect legend navigation action color.
- The documentation link to the "Configuration Dashboards" should be corrected in the "VMC-D Configuration" dashboard.
- Inconsistency between Alert block color and icon.
- [Custom Profile] Inconsistent Alert block.
- Inconsistent "Info" button style and behavior.
- Cost data is not shown properly in the "Cost Overview" in dark mode.
- Cloud Proxy standard alerts update.
- Tooltips and signposts inconsistencies over the product.
- Management Pack Builder link should navigate to Management Pack Builder landing page.
- [Access Control] Role editing is completed with an error in the console and VMware Aria Operations is hung.
- [Log Integration] [Cloud] ANY operator doesn't work for any Logs page, when multiple filter criteria is set.
- Remove cloud proxy doesn't work properly.
- Objects in maintenance mode shouldn't have alerts triggered based on notifications sent by outside source.
- Wrong place and styles of close and help icons in Policy, Integrations add/edit pages.
- [Log Integration] Need to have info/warn message window in VMware Aria Operations Logs pages, when there is no configured credential in VMware Aria Operations for Logs Cloud Account.
- Finalization of unification "Alert" banners.
- [Developer Center][Cloud] The link for the API documentation should be corrected.
- Icon and object name overlap in the described case.
- [Launchpad] Inconsistency between the actual and the confluence version links for the "Horizon" -> "User Performance" card.
- Replace local "Application Details" and "Application Preview" local panels with generic "Right Panel".
- Incorrect action color used in "Edit Group", "Collector Group", "View Details" and other page.
- Issue with GET /api/symptoms endpoint not returning faultDevices field.
- Roll-up menu icon is empty.
- Issue with Cloud Proxy's root passwords.
- [App Monitoring] ARC adapter status is warning when VMware Aria Operations license is Standard and alert triggered on ARC adapters.
- Replace 'InfoPanel' irregular component by 'HintContainer' with signpost inside everywhere in the project.
- Replace inconsistent Info tool icon with standardInfo component everywhere we can.
- Incorrect Action color in "Cloud Management Assessment" and "Explore Our Dashboards" panels.
- Few VMs do not have reclamation cost calculated for a day.
- Incorrect warning message in Manage Workload Automation Policy Window.
- [Rebranding] In some error messages for the SDMP used incorrect product name.
- Effective Disk Space cost does not consider allocation costs when allocation model is only enabled for disk space.
- [AWS] Some nameKeys in describe.xml are not localized.
- Remove unnecessary "getClrIcon" function from project.
- [Collector Group] Provide info message that collector group rebalance is in progress and update object/adapter instance counts when task is completed.
- Incorrect action color and unequal top paddings in "Payload Templates" edit form.
- Physical Data Centers Edit form tree panel header height increase. From (24 to 36) px..
- Incorrect, inconsistent, irregular custom "clr" icons.
- List view excludes metric data when instance breakdown is enabled, and some instance metrics are problematic.
- The "Edit" Notification Rule created using the Swagger results in an "Internal Server Error" message.
- The Notifications page in the UI becomes empty when creating a "Notification Rule" using Swagger, when setting the "alertDefinitionIdFilters" parameter with an incorrect value.
- [App Monitoring] RCs that are part of Application Monitoring HA disabled collector group should not be allowed to select from the "Installing Telegraf Agent" wizard.
- [Log Integration] [Certificate] Auto-accept of imported certificate doesn't work properly for the VMware Aria Operations for Logs Cloud Account.
- [Licensing] License input dialog does not appear when removing the last valid license.
- [Metric Search in Global Search] The coloring of the min and max values should be changed in the described case.
- Update Resource relationship advanced panel toolbar.
- Same tool has different functionality in different widgets.
- Adding Log Analysis widget on dashboard takes forever.
- Same tool has different functionality in different widgets (Reset interaction and Clone).
- [Rebranding] Product name is incorrect in the "Page not found" error page.
- GCP MP update HTTP request call with Proxy Server details.
- Change resource relationship "Text" button tooltip. (Hide Text > Show Text).
- [License] Modify text in the dialog when a license key is added.
- [App Monitoring] "/api/applications/vcenter/add" and "/api/applications/vcenter/remove" rest api calls needs should be deprecated.
- [Summary] It would be better to change CPU and memory limit values in the "Summary" page.
- Create and replace everywhere in the project "Resource Status" and "Resource State" icons.
- The object type selection component does not work correctly.
- Period should be appended for some sentences in the settings page.
- [Outbound plugin] RuntimeException is thrown when deleting and then selecting another credential in Webhook plugin.
- Clarity styles small correction. Remove unexpected bordex padding.
- [Dashboards] Wrong counting of interactions.
- [Outbound Settings] User is unable to add/edit an Outbound Setting without Business Application's "Edit" permission.
- Alert / Symptom visualization issue.
- [NSX-T MP] Duplicate Metric Definition in describe.xml.
- [Licensing] The "Add License" window issue arises in the described case.
- Some issues related to the "Suggested Fix" column on the "Alerts"/"Administrative Alerts" pages.
- [Service Discovery] For the IIS service, the install path is incorrect.
- Unable to perform a metric search in the described case.
- [Custom Groups] Using XSS in the Custom Groups (Custom Groups Types) name field brings an issue in the Custom Groups(Custom Groups Types) grid.
- [Custom Datacenter] Using XSS in the Custom Datacenters name field brings an issue in the Custom Datacenters grid.
- [Environment] [Object Browser] Scroll is broken in Object Browser page.
- Use signpost instead of custom tooltip in Custom Groups and Inventory grids.
- Sustainability metrics' and page contain units that are not presented with right abbreviations (Kg->kg, KWh->kWh).
- Some issues related to tooltips.
- [Cost Analysis] Grid sorting by "Modified by" on "Saved Analyses" page is not working correctly.
- [Data Range Picker] An empty option is present in data range picker in the described case.
- Filtering alerts while alert preview is enabled results in most alerts disappearing.
- Distribute Horizon Connected Users usage count across Horizon hosts.
- [Automation Central] XSS script is working, when the job name consists of XSS script.
- The services list appears incorrectly in the "Edit Custom application" window.
- New badge has incorrect space between edge and corners.
- No Credential authentication method is set in outbound setting/synthetic monitoring configurations after cancelling the modification.
- No Credential authentication method is set in synthetic monitoring configurations after cancelling the modification.
- [Alert]In the triggered grid by clicking on refresh button, the action button is enabled and disabled.
- [Cost Analysis] XSS scripts are working on the "Cost Analysis" page.
- [Launchpad] OCVS Learn more content is incorrect.
- The VM's are being mapped with wrong license in Cost Driver Screen.
- [Licensing] The "Add License Group" wizard issue arises in the described case.
- Filtering issue by view from option with traversal spec selection in Object Details page.
- Changing the Scope in Troubleshooting Workbench reverts the Scope Level back to one.
- License names are not visible in customize license assignment dialog in dark theme mode.
- [Global Search] Global search is not working when the input symbols are 2.
- [Dashboards] Obsolete Cassandra content.
- [Alerts] Alert list is not displayed in object details' Alerts tab after grouping by 'Scope' and then refreshing the page.
- [Azure MP] Issue with properties with frequent value changes.
- Two different pages for Compliance management packs in Launchpad and Repository.
- [Alerts] The alerts list is empty when grouped by 'Scope' and filtered by 'Alert Type'.
- NSX-API "api/v1/transport-zones/transport-node-status" this collective API is not returning vm_uuid.
- [Outbound Settings] Export functionality is broken for Webhook plugin outbound setting when OAuth credential type is specified in the described case.
- [Alerts] "Related Alerts" disappears when performing any action on alert.
- [Alerts] Canceled Alert does not Disappear Immediately from the List of Active Alerts.
- [Alerts] "Cancel Deleted Alerts" not working after first refresh.
- The "Manage Views" page behaves unexpectedly in the described case.
- Missing UserName in UI when creating SNMP Trap Outbound Plugin using REST API POST: api/Alertplugins call.
- The "Alerts" filtering component breaks when scrolling the page.
- Unable to see the groups that dashboard shared with in Manage Dashboard Sharing page.
- [Global Settings] 'Show Cost Savings' global setting's description should be updated.
- Service Now plugin's http connection session never timeouts.
- [Service Discovery] Service Discovery adapter changed status to "collector down" after upgrading the cloud.
- NTP service was down on some nodes of cluster after system update.
- Disable the Begin Action button if Required fields are not entered.
- [Outbound plugin] The outbound plugin sends triggered alert data without filtering them based on object accessibility.
- [Alerts] The last item in the expanded view of the alerts group is visible partially.
- Fix Policy Long Name issue in summary pages.
- [Cloud Proxy] /suite-api not autoroute to "suite-api/doc/swagger-ui.html".
- Support bundle generation on FIPS enabled Cloud Proxy does not working.
- CA enable causes cluster to enter Failure state.
- [Cost Analysis] Unnecessary pop-up window is getting displayed in the described case.
- [Reports] Change in CSH Help IDs.
- Internal Server Error occurs when navigating "Notifications" page without having permission to view Outbound Settings.
- No Policy Settings in Policy Preview for the limited access user.
- Unauthorized Access to Custom Groups and Custom Datacenters Pages.
- Agent Installation is failing due to client certificate not generated for Horizon Server VMs with Windows Server edition 2019/2016 on Aria Ops (FIPS Enabled).
- [Policies] Missing scrollbar in the Edit or Create Super Metrics page in Step 4.
- Aria Operations Allocation Cost.
- [Policy] Some characters are encoded in the "Policy Assignment" page when applying a filter.
- Video size in Launchpad.
- [Aria OPs][Sustainability UI Page Changes] Change the text for the formula of Efficiency in Sustainability Home Page.
- In case of big power consumption "Power consumption" widget in the sustainability doesn't show all the number.
- Getting js error on creating application/service definition.
- [Cloud Proxy] Cloud proxy upgrade fails due to "IS_FIPS" environmental variable.
- Dashboards changing names after activation.
- [Custom Groups] usability improvements in property value picker in define membership step with "load more".
- Unable to save server batches that have the same value.
- [Alerts] Alerts are sorted according to a predetermined list instead of alphabetically.
- Cost overview shows an incorrect datacenter ID.
- Problem in "ESXi Host is violating CIS (v7 and above)" alert definition.
- [Policy] Directly assigned objects are not displayed in the policy library right pane for the limited access user.
- Old style icons in Reports page.
- Get Top Processes API return "Unknown" error.
- The object summary page is empty.
- Email reports have email address length limitation not found in other places.
- [Workload Placement] There is no ability to Perform Workload Optimization on the container, which child cluster is under the VMware Aria Operations maintenance mode.
- [Licensing] The "Add License" window remains open while reloading the page.
- NPE in AWS MP on KinesisFireHose service manager.
- Cost data is not shown properly in the "Cost Overview" in dark mode.
- [NSX-T MP] Please change the NSX-T's Benchmark Title as "NSX Security Configuration Guide".
- Mismatched closing tags in file /light/overview.html of vsan and ensemble.
- [Object scope] cloud zones do not appear in respective page If object scope does not contain VMware Aria Automation integration instance.
- [Cost Analysis] Some issues on exported cost analysis pdf file.
- js error occurs in the Alert Definition creation flow.
- [Launchpad] Some documentation links redirect to the wrong pages according to the confluence.
- [Launchpad] Documentations' link mismatching between confluence and implementation.
- [Dashboards] Changes to Carbon Transparency Dashboards.
- [Metric Search in Global Search] The scroll button does not work with the recommended scale and display resolution.
- [Outbound plugin] Basic Authentication credentials are not being updated when the user updates them after creation.
- [Recent Tasks] [WLP Action]Long time lasting VM moves on VC needs to be handled properly in VMware Aria Operations Recent Tasks > WLP Actions statuses.
- OOTB view names should be corrected.
- [Outbound plugin] 'VMware Hosted Email Plugin' outbound setting does not work after the user tries to edit it.
- [DISA and FISMA compliance pack] Issue with "Port Config Reset at Disconnect" symptom definition.
- [Alert Definitions] 'Is User Defined' column's values are incorrect.
- [WLP] [Back-end] Sometimes the WLP automation was not run successfully, with "Not Dispatched" status in Recent Tasks page.
- The "Discard Changes" warning message does not appear in the described case.
- NPE in com.vmware.vcops.bridge.server.AdminManager#getMultiCloudAdapterInstances.
- [VIH MP][VMware Infrastructure Health] VMware Aria Automation health services are not being collected.
- Unable to "Power Off" suspended VM from Parent Objects.
- [Launchpad] Some documentation links redirect to the wrong pages according to the confluence.
- [Launchpad] Documentations' link mismatching between confluence and implementation.
- Disabling costing metrics is not honored for objects from VMC adapter.
- Need to handle NULL values in VM's "CloudAutomation|CustomProperties" for the CloudZone ID, to get the proper Aria Operations price calculation on VMs.
- [Lint Plugin] NullPointer exception in Lint plugin.
The following CVEs have been resolved as of vRealize Operations 8.14:
Component Name |
CVE |
berkeleydb |
CVE-2016-0682 |
CVE-2016-0689 |
CVE-2016-0692 |
CVE-2016-0694 |
CVE-2016-3418 |
CVE-2017-3604 |
CVE-2017-3605 |
CVE-2017-3606 |
CVE-2017-3607 |
CVE-2017-3608 |
CVE-2017-3609 |
CVE-2017-3610 |
CVE-2017-3611 |
CVE-2017-3612 |
CVE-2017-3613 |
CVE-2017-3614 |
CVE-2017-3615 |
CVE-2017-3616 |
CVE-2017-3617 |
c-ares |
CVE-2023-31124 |
CVE-2023-31130 |
CVE-2023-31147 |
CVE-2023-32067 |
cloud-init |
CVE-2023-1786 |
com.google.guava:guava |
CVE-2018-10237 |
CVE-2020-8908 |
CVE-2023-2976 |
cryptography |
CVE-2023-23931 |
curl |
CVE-2023-28319 |
CVE-2023-28320 |
CVE-2023-28321 |
CVE-2023-28322 |
CVE-2023-38039 |
dbus |
CVE-2020-12049 |
CVE-2020-35512 |
elfutils |
CVE-2020-21047 |
gcc |
CVE-2019-14250 |
CVE-2021-37322 |
glibc |
CVE-2016-10228 |
CVE-2019-1010023 |
CVE-2019-1010024 |
CVE-2019-1010025 |
CVE-2020-29562 |
gnutls |
CVE-2021-4209 |
golang-runtime |
CVE-2023-39320 |
CVE-2023-39321 |
CVE-2023-39322 |
grub2 |
CVE-2021-3981 |
icu |
CVE-2016-6293 |
CVE-2017-14952 |
CVE-2017-15396 |
CVE-2017-15422 |
CVE-2017-17484 |
CVE-2017-7867 |
CVE-2017-7868 |
CVE-2020-10531 |
icu |
CVE-2020-21913 |
libpng |
CVE-2018-13785 |
CVE-2018-14048 |
CVE-2018-14550 |
CVE-2019-6129 |
CVE-2019-7317 |
libssh2 |
CVE-2020-22218 |
linux_kernel |
CVE-2015-2877 |
CVE-2018-5407 |
CVE-2019-19378 |
CVE-2019-19769 |
CVE-2020-26140 |
CVE-2020-26141 |
CVE-2020-26145 |
CVE-2022-1280 |
CVE-2022-20166 |
CVE-2022-23816 |
CVE-2022-3238 |
CVE-2022-36402 |
CVE-2022-38096 |
CVE-2023-1206 |
CVE-2023-2007 |
CVE-2023-21255 |
CVE-2023-3390 |
CVE-2023-35001 |
CVE-2023-3611 |
CVE-2023-3772 |
CVE-2023-3776 |
CVE-2023-3863 |
CVE-2023-40283 |
CVE-2023-4128 |
CVE-2023-4206 |
CVE-2023-4207 |
CVE-2023-4208 |
CVE-2023-4622 |
lxml |
CVE-2021-43818 |
CVE-2022-2309 |
nss |
CVE-2022-38476 |
open-vm-tools |
CVE-2023-20900 |
openssh |
CVE-2016-20012 |
CVE-2020-15778 |
CVE-2021-36368 |
openssl |
CVE-2018-0732 |
CVE-2018-0734 |
CVE-2018-0737 |
CVE-2018-0739 |
CVE-2018-5407 |
CVE-2019-1547 |
CVE-2019-1551 |
CVE-2019-1552 |
CVE-2019-1559 |
CVE-2019-1563 |
CVE-2020-1968 |
CVE-2020-1971 |
CVE-2021-23840 |
CVE-2021-23841 |
CVE-2021-3712 |
CVE-2022-0778 |
CVE-2022-1292 |
CVE-2022-2068 |
CVE-2022-3996 |
CVE-2022-4203 |
CVE-2022-4304 |
CVE-2022-4450 |
CVE-2023-0216 |
CVE-2023-0217 |
CVE-2023-0286 |
CVE-2023-0401 |
CVE-2023-0465 |
CVE-2023-0466 |
org.apache.tomcat:tomcat-util |
CVE-2023-34981 |
org.json:json |
CVE-2022-45688 |
org.springframework.boot:spring-boot |
CVE-2023-20873 |
CVE-2023-20883 |
patch |
CVE-2019-20633 |
phantomjs |
CVE-2019-17221 |
postgresql |
CVE-2023-2454 |
CVE-2023-2455 |
CVE-2023-32305 |
pycrypto |
CVE-2013-7459 |
CVE-2018-6594 |
python |
CVE-2018-25032 |
CVE-2022-48560 |
CVE-2022-48564 |
CVE-2022-48565 |
CVE-2022-48566 |
python-cryptography |
CVE-2020-25659 |
qt |
CVE-2015-9541 |
CVE-2017-10904 |
CVE-2017-10905 |
CVE-2018-15518 |
CVE-2018-19865 |
CVE-2018-19869 |
CVE-2018-19870 |
CVE-2018-19871 |
CVE-2018-19872 |
CVE-2018-19873 |
CVE-2018-21035 |
CVE-2019-18281 |
CVE-2020-0569 |
CVE-2020-12267 |
CVE-2020-17507 |
CVE-2020-24742 |
CVE-2021-38593 |
CVE-2022-25634 |
CVE-2023-24607 |
CVE-2023-32573 |
CVE-2023-32762 |
CVE-2023-32763 |
CVE-2023-33285 |
CVE-2023-34410 |
CVE-2023-37369 |
CVE-2023-38197 |
CVE-2023-43114 |
selinux |
CVE-2021-36087 |
shadow |
CVE-2013-4235 |
sqlite3 |
CVE-2017-10989 |
CVE-2017-13685 |
CVE-2017-2518 |
CVE-2017-2519 |
CVE-2017-2520 |
CVE-2018-20346 |
CVE-2018-20505 |
CVE-2018-20506 |
CVE-2018-8740 |
CVE-2019-16168 |
CVE-2019-19242 |
CVE-2019-19244 |
CVE-2019-19317 |
CVE-2019-19603 |
CVE-2019-19645 |
CVE-2019-19646 |
CVE-2019-19880 |
CVE-2019-19924 |
CVE-2019-19959 |
CVE-2019-20218 |
CVE-2019-5018 |
CVE-2019-5827 |
CVE-2019-8457 |
CVE-2019-8598 |
CVE-2019-8600 |
CVE-2019-8602 |
CVE-2020-13434 |
CVE-2020-13435 |
CVE-2020-13630 |
CVE-2020-13631 |
CVE-2020-13632 |
CVE-2020-13871 |
CVE-2020-35525 |
CVE-2020-9327 |
CVE-2021-45346 |
CVE-2022-46908 |
systemd |
CVE-2019-14899 |
CVE-2023-26604 |
vim |
CVE-2023-4733 |
CVE-2023-4734 |
CVE-2023-4735 |
CVE-2023-4736 |
CVE-2023-4738 |
CVE-2023-4750 |
CVE-2023-4751 |
CVE-2023-4752 |
CVE-2023-4781 |
xerces-c |
CVE-2018-1311 |
xerces-c++ |
CVE-2012-0880 |
CVE-2018-1311 |
zlib |
CVE-2016-9840 |
CVE-2016-9841 |
CVE-2016-9842 |
CVE-2016-9843 |
CVE-2018-25032 |