CSP-91401 - Patch instructions to upgrade OpenSSH version

Products

VMware Aria Suite

Issue/Introduction

Patch Superseded

This patch (CSP-91401) has been superseded and is no longer available. Please install the latest cumulative update, CSP-102092, by following the instructions in KB 412021.

Vulnerabilities Addressed by This (Superseded) Patch

This article provides information on a previous patch (CSP-91401) that upgraded OpenSSH to fix the security vulnerability listed below.

Affected Product

VMware Identity Manager Appliance: 3.3.7

Applicable CVEs

CVE-2023-38408

Environment

VMware Identity Manager 3.3.x

Resolution

Prerequisites (for Superseded Patch CSP-91401)

Version Support: It is recommended to upgrade any unsupported product versions to a supported version before patching. Please refer to the Broadcom Product Lifecycle Matrix.
Snapshots/Backups: It is strongly recommended to take a snapshot or backup of the appliance(s) and the database server before proceeding.

Procedure (for Superseded Patch CSP-91401)

Log in to the VMware Identity Manager appliance via SSH as sshuser and elevate to the root user with sudo su -.
Download and transfer the CSP-91401-Appliance-3.3.7.zip file to a temporary location on the virtual appliance.

Unzip the file into a new directory:

unzip CSP-91401-Appliance-3.3.7.zip -d CSP-91401-Appliance-3.3.7

Navigate into the new directory:
```
cd CSP-91401-Appliance-3.3.7
```
Run the patch script:
```
./CSP-91401-applyPatch.sh
```

Note: For a clustered deployment, repeat the steps above on all additional nodes sequentially.

Validation (for Superseded Patch CSP-91401)

After the patch deployment, perform the following steps to confirm it was applied successfully:

Log in to the VMware Identity Manager Console and verify the System Diagnostics page shows a green status.

Verify that the patch flag file has been created:

ls /usr/local/horizon/conf/flags/CSP-91401-3.3.7-hotfix.applied

Attempt to log in to the appliance via SSH as the sshuser or root user from a new session to confirm access.

Additional Information

To revert this patch, revert to the appliance(s) snapshot and the database backup taken before applying these steps.