How to check if VMware Aria Suite Lifecycle 8.18.x is affected by CVE

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Found a number of vulnerabilities reported in VMware Aria Suite Lifecycle 8.18 by a vulnerability scanner and want to confirm what version is the CVEs fixed in

Environment

VMware Aria Suite Lifecycle 8.18.x

Resolution

1. Open ssh to VMware Aria Suite Lifecycle node as root
2. Run the command: 

   rpm qa -changelog | grep <CVE>

    Note replace <CVE> with the affected CVE 

3. If this command returns some result, that means that particular CVE has been fixed. If it does not return the result then raise a support request as per kb Creating and managing Broadcom support cases