False Positive Vulnerabilities (CVE-2021-47469, CVE-2021-3421, etc.) reported by security scanners against VMware NSX

Products

• VMware NSX

Issue/Introduction

VMware NSX environments may be flagged by third-party security vulnerability scanners for a series of CVEs. 

The reported vulnerabilities include, but are not limited to:
- CVE-2021-47469
- CVE-2021-3421, CVE-2021-20230, CVE-2021-20266, CVE-2021-20271
- CVE-2022-39348, CVE-2022-40898, CVE-2022-44792
- CVE-2021-33503, CVE-2021-45078
- Various Linux kernel CVEs (e.g., CVE-2021-46926, CVE-2021-47001, CVE-2022-0001, CVE-2022-36402, CVE-2022-38096)
- CVE-2022-22817, CVE-2022-24303
- CVE-2019-9511, CVE-2019-9513

Environment

VMware NSX 4.2.x

Cause

These vulnerabilities are false positives resulting from outdated scanner signature databases or incorrect package identification by the scanning tool.

Engineering analysis of the NSX Bill of Materials (BOM) confirms the following:
- **Packages Not Consumed:** The packages `rpm`, `stunnel`, `twisted`, `python-pip`, `wheel`, and `net-snmp` are not utilized by the NSX appliance.
- **Packages Not Affected:** The packages `python-urllib3`, `binutils`, and `pillow` are present but not affected by the flagged CVEs in versions 4.2.2 and 9.2.
- **Kernel False Positives:** Multiple Linux kernel CVEs were incorrectly flagged against kernel versions 5.15.123-nn1 and linux_6.6.116.
- **Previously Resolved:** CVE-2019-9511 and CVE-2019-9513 were resolved in NSX version 4.1.1.
- **Withdrawn CVEs:** CVE-2021-47469 has been formally rejected and withdrawn by its CVE Numbering Authority.

Resolution

To resolve the reporting discrepancies:

1. Update the third-party vulnerability scanning tool and its vulnerability signature database to the latest available versions.
2. Rerun the vulnerability scan against the VMware NSX environment.
3. If the scanner continues to flag packages that are not consumed by NSX (such as `rpm` or `stunnel`), identify the exact file paths being flagged by the tool within the appliance.
4. Provide the updated scan results, the exact file paths, and the application name and version of the vulnerability scanner to VMware Support for further investigation.

Additional Information

Vulnerability scanners often rely on banner grabbing or superficial package checks. For definitive vulnerability status, always reference the official VMware Security Advisories (VMSA)