Reported CVE Vulnerability validation for vCenter Server Appliance
Article ID: 436357
Updated On:
Products
Issue/Introduction
Security scanners such as Qualys, Nessus, or Tenable frequently report Common Vulnerabilities and Exposures (CVEs) related to the underlying Photon OS of the vCenter Server Appliance (VCSA). These reports often flag libraries like glibc, openssl, or python3 based on versioning. This article provides the methodology to validate whether these findings are true positives or false positives and outlines the official remediation process.
Environment
- VMware vCenter Server Appliance 7.x, 8.x
- VMware Cloud Foundation (VCF) 4.x, 5.x
Cause
Security scans (e.g. Qualys, Nessus, Tenable) against vCenter report vulnerabilities (CVEs)
Resolution
Validate a reported vulnerability using the following procedure:
1. Identify OS and Package Versions
Access the vCenter Server Appliance via SSH and execute the following commands to determine the current state:
- Check OS Version:
cat /etc/photon-release - Check Specific Package Version: Replace
[package_name]with the name provided in your security scan (e.g., python3):rpm -qa | grep [package_name]
2. Compare Against Official Advisories
Compare the installed package version against the "Fixed Version" listed in these official sources:
Validation Criteria:
- False Positive: If the installed version is equal to or higher than the listed Fixed Version.
- True Positive: If the installed version is lower than the Fixed Version.
3. Remediation Policy
Broadcom does not support manual or out-of-band RPM package upgrades (via tdnf or rpm) within the VMware appliance. Such modifications can destabilize the system and place the appliance in an unsupported state.
Security fixes are delivered exclusively through official product releases and cumulative patches.
4. If further validation is require from Broadcom Support, please provide the following when creating a case:
- Full scan report and scanner vendor details.
- Output of 'cat /etc/photon-release'.
- Output of 'rpm -qa' from the affected appliance.
- VMware product and version details.
Additional Information
Feedback
