VMSA-2021-0028

• VMware Horizon
• VMware vCenter Server
• VMware HCX
• VMware NSX-T Data Center
• VMware Unified Access Gateway
• VMware WorkspaceOne Access
• VMware Identity Manager 
• VMware vRealize Operations
• VMware vRealize Operations Cloud Proxy
• VMware vRealize Automation
• VMware vRealize Lifecycle Manager
• VMware Site Recovery Manager, vSphere Replication
• VMware Carbon Black Cloud Workload Appliance
• VMware Carbon Black EDR Server
• VMware Tanzu GemFire
• VMware Tanzu GemFire for VMs
• VMware Tanzu Greenplum
• VMware Tanzu Operations Manager
• VMware Tanzu Application Service for VMs
• VMware Tanzu Kubernetes Grid Integrated Edition
• VMware Tanzu Observability by Wavefront Nozzle
• Healthwatch for Tanzu Application Service
• Spring Cloud Services for VMware Tanzu
• Spring Cloud Gateway for VMware Tanzu
• Spring Cloud Gateway for Kubernetes
• API Portal for VMware Tanzu
• Single Sign-On for VMware Tanzu Application Service
• App Metrics
• VMware vCenter Cloud Gateway
• VMware vRealize Orchestrator
• VMware Cloud Foundation
• VMware Workspace ONE Access Connector
• VMware Horizon DaaS
• VMware Horizon Cloud Connector
• VMware NSX Data Center for vSphere
• VMware AppDefense Appliance
• VMware Cloud Director Object Storage Extension
• VMware Telco Cloud Operations
• VMware vRealize Log Insight
• VMware Tanzu Scheduler
• VMware Smart Assurance NCM
• VMware Smart Assurance SAM [Service Assurance Manager]
• VMware Integrated OpenStack
• VMware vRealize Business for Cloud
• VMware vRealize Network Insight
• VMware Cloud Provider Lifecycle Manager 
• VMware SD-WAN VCO
• VMware NSX-T Intelligence Appliance
• VMware Horizon Agents Installer
• VMware Tanzu Observability Proxy
• (Additional products will be added)

Critical vulnerabilities in Apache Log4j identified by CVE-2021-44228 and CVE-2021-45046 have been publicly disclosed which impact VMware products. 

This is an ongoing event, please check this advisory for frequent updates as they develop.

Multiple products impacted by remote code execution vulnerabilities via Apache Log4j (CVE-2021-44228, CVE-2021-45046).

A malicious actor with network access to an impacted VMware product may exploit these issues to gain full control of the target system.

Fixes for CVE-2021-44228 and CVE-2021-45046 are documented in the ‘Fixed Version’ column of the ‘Response Matrix’ below.

Workarounds for CVE-2021-44228 and CVE-2021-45046 are documented in the ‘Workarounds’ column of the ‘Response Matrix’ below.

None.

None.

• Exploitation attempts in the wild have been confirmed by VMware.
• A supplemental blog post & frequently asked questions list was created for additional clarification. Please see: https://via.vmw.com/vmsa-2021-0028-faq
• Unaffected VMware products can be referred to on the Knowledge Base article: https://kb.vmware.com/s/article/87068
• On December 14, 2021 the Apache Software Foundation notified the community that their initial guidance for CVE-2021-44228 workarounds were not sufficient in removing all possible attack vectors. In addition, a new vulnerability identified by CVE-2021-45046 was published. In response, VMware has aligned with the new guidance and will be updating associated documentation with workarounds and fixes to address both vulnerabilities completely.
• On December 17, 2021 the Apache Software Foundation updated the severity of CVE-2021-45046 to 9.0, in response we have aligned our advisory.  

2021-12-10: VMSA-2021-0028
Initial security advisory.

2021-12-11: VMSA-2021-0028.1

Updated advisory with workaround information for multiple products including vCenter Server Appliance, vRealize Operations, Horizon, vRealize Log Insight, Unified Access Gateway.

2021-12-13: VMSA-2021-0028.2

Revised advisory with updates to multiple products.

2021-12-15: VMSA-2021-0028.3

Revised advisory with updates to multiple products. In addition, added CVE-2021-45046 information and noted alignment with new Apache Software Foundation guidance. 

2021-12-17: VMSA-2021-0028.4

Revised advisory with updates to multiple products.

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

This Security Advisory is posted to the following lists:  

security-announce@lists.vmware.com  

bugtraq@securityfocus.com  

fulldisclosure@seclists.org 

E-mail: security@vmware.com

PGP key at:

https://kb.vmware.com/kb/1055 

VMware Security Advisories

https://www.vmware.com/security/advisories 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

Twitter

https://twitter.com/VMwareSRC

Copyright 2021 VMware Inc. All rights reserved.