The workarounds described in this document are meant to be a temporary solution only.
Upgrades documented in the aforementioned advisories should be applied to resolve vulnerabilities in impacted plugins.
Workaround:
Important: Plugins must be set to "incompatible." Disabling a plugin from within the UI does not prevent exploitation.
The following actions must be performed on both the active and passive nodes in environments running vCenter High Availability (VCHA).
The examples documented here show the steps to disable all plugins which have been impacted by vulnerabilities disclosed by VMware. Depending on the environment and requirements, there may only be a need to disable a subset of these plugins.
Please see the VMSA-2021-0010: What You Need to Know blog to determine the plugins that are required to be disabled in the configuration being used.
Add the lines below to the compatibility-matrix.xml file to disable each individual plugin:
Plugin Name | Configuration Line |
VMware vRops Client Plugin | <PluginPackage id="com.vmware.vrops.install" status="incompatible"/> |
VMware vSAN H5 Client Plugin | <PluginPackage id="com.vmware.vsphere.client.h5vsan" status="incompatible"/> |
Site Recovery | <PluginPackage id="com.vmware.vrUi" status="incompatible"/> |
VMware vSphere Life-cycle Manager | <PluginPackage id="com.vmware.vum.client" status="incompatible"/> |
VMware Cloud Director Availability | <PluginPackage id="com.vmware.h4.vsphere.client" status="incompatible"/> |
Some plugins are enabled by default, and these default plugins differ from version to version.
Please refer to the table below to determine which plugin is enabled by default and which plugin requires the associated product to be installed and configured.
vCenter Version | vRealize Operations | vSAN | VMware vSphere Life-cycle Manager | Site Recovery | VMware Cloud Director Availability |
6.5 | Default | Default (6.5 U3k and later) | N/A | Product | Product |
6.7 | Default | Default | N/A | Product | Product |
7.0 | Default | Default | Default | Product | Default |
To implement the workaround, follow the steps applicable for the type of vCenter Server deployment being used.
Quick link:
For vSphere 7.0:
For vSphere 6.7:
From the vSphere Client (HTML 5), the disabled plugins can be seen as incompatible under Administration > Solutions > client-plugins as shown below:
For up-to-date information as well as future security information please sign up for VMware Security Advisories announcements at our mailing list portal. RSS feeds are also available on the advisories themselves.
Revert the Workaround
To revert the workaround, follow the steps applicable for the type of vCenter Server deployment being used.
Quick link:
For more information on how to start/stop/restart services see:
For more information on how to start/stop/restart services see:
Impact/Risks:
Functionality impacts are limited to environments that utilize VMware plugins. Disablement of these plugins will result in a loss of management and monitoring capabilities provided by the plugins.