Recently, VMware has issued a security notice to alert that many VMware products are affected by the Apache Log4j2 remote code execution vulnerability (CVE-2021-44228). Because some functions of Apache Log4j2 have recursive parsing functions, unauthenticated attackers can execute arbitrary code in the affected VMware products by sending specially constructed data request packets. The PoC of the CVE-2021-44228 vulnerability has been made public and has been exploited in the wild.
Impacted Products (Under Evaluation)
VMware Horizon
VMware vCenter Server
VMware HCX
VMware NSX-T Data Center
VMware Unified Access Gateway
VMware WorkspaceOne Access
VMware Identity Manager
VMware vRealize Operations
VMware vRealize Operations Cloud Proxy
VMware vRealize Automation
VMware vRealize Lifecycle Manager
VMware Site Recovery Manager, vSphere Replication
VMware Carbon Black Cloud Workload Appliance
VMware Carbon Black EDR Server
VMware Tanzu GemFire
VMware Tanzu Greenplum
VMware Tanzu Operations Manager
VMware Tanzu Application Service for VMs
VMware Tanzu Kubernetes Grid Integrated Edition
VMware Tanzu Observability by Wavefront Nozzle
Healthwatch for Tanzu Application Service
Spring Cloud Services for VMware Tanzu
Spring Cloud Gateway for VMware Tanzu
Spring Cloud Gateway for Kubernetes
API Portal for VMware Tanzu
Single Sign-On for VMware Tanzu Application Service
App Metrics
VMware vCenter Cloud Gateway
VMware vRealize Orchestrator
VMware Cloud Foundation
VMware Workspace ONE Access Connector
VMware Horizon DaaS
VMware Horizon Cloud Connector
VMware NSX Data Center for vSphere
VMware AppDefense Appliance
VMware Cloud Director Object Storage Extension
VMware Telco Cloud Operations
VMware vRealize Log Insight
VMware Tanzu Scheduler
VMware Smart Assurance NCM
VMware Smart Assurance SAM [Service Assurance Manager]
VMware Integrated OpenStack
VMware vRealize Business for Cloud
(Additional products will be added)
At present, VMware has released a new version for the following products to fix the vulnerability, please affected users to upgrade the version as soon as possible, the download link and document of the corresponding product version are as follows:
