eMudhra compromised certificates and VMware by Broadcom product portfolio updates

Products

• VMware Cloud Foundation
• VMware Cloud Director
• VMware HCX
• VMware Workstation
• VMware Telco Cloud Platform
• VMware Fusion

Issue/Introduction

• Eight eMudhra Intermediate Certificate Authority (CA) certificates have been compromised. A malicious actor, on a compromised network, could exploit this high severity vulnerability to Man-in-the-middle encrypted TLS communication intended for impacted products. 

Environment

• VMware Cloud Foundation (VCF) and VMware vSphere Foundation (VVF) components and add-ons, versions 5.2.4 and 9.1.1. See the VCF 5.2.4 BOM and VCF 9.1.1 BOM for a list of components
• VMware Cloud Director
• VMware Remote Console
• HCX
• PowerCLI
• VMware Telco Cloud Platform
• VMware Workstation
• VMware Fusion

Cause

• The compromise of the eMudhra Intermediate CA certificates was due to a cryptographic weakness.

Resolution

• VMware by Broadcom products will address this high severity vulnerability in upcoming product releases and documentation.