Impact of CVE-2024-39894 on vCenter Server Appliance

Products

• VMware vCenter Server

Issue/Introduction

CVE-2024-39894 affects OpenSSH versions 9.5 to 9.7, as per https://nvd.nist.gov/vuln/detail/CVE-2024-39894

Environment

vCenter Server Appliance 6.x
vCenter Server Appliance 7.x
vCenter Server Appliance 8.x

Cause

As per the CVE description, "OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur."

Resolution

vCenter Server 8.0U3a uses OpenSSH version 8.9p1 which is not impacted by CVE-2024-39894.

vCenter Server 6.7 U3v uses OpenSSH_7.4p1.

vCenter Server 7.0 U3t uses OpenSSH_7.8p1.

The vCenter versions 6.7 and 7.0 across all the updates use 8.9p1 or lower versions of OpenSSH, hence they are not impacted.