Обновление vCenter 6.7.0.51000

Олег

25 ноября 2021

23 ноября 2021 года для vCenter вышло обновление 6.7.0.51000. Патч CVE-2021-21980 и CVE-2021-22049.

vCenter — уязвимости в веб клиенте FLEX/Flash

vCenter Server Appliance 6.7 Update 3p

Подробнее:

https://docs.vmware.com/en/VMware-vSphere/6.7/rn/vsphere-vcenter-server-67u3p-release-notes.html

О патче:

Download Filename: VMware-vCenter-Server-Appliance-6.7.0.51000-18831133-patch-FP.iso
Build: 18831133
Download Size: 2051.6 MB
md5sum: 3527843005139d0887210fdd3981212d
sha256checksum: db2021a66fc70e0d2dadb85210b70b2fdea6ac04a2b8dd8ac8cf5f2fc2145cce

Отдельно патч для VC можно скачать здесь:

https://my.vmware.com/group/vmware/patch#search

Исправления безопасности

Патч исправляет уязвимости:

CVE-2021-21980 CVSSv3 7.5. Злоумышленник может получить доступ к важной информации по порту 443 в Web Client (FLEX/Flash).
CVE-2021-22049. SSRF (Server Side Request Forgery) уязвимость в плагине vSAN Web Client (vSAN UI). Злоумышленник может делать URL запросы вне vCenter или обратиться к внутренней службе.

Дополнительно:

CVE-2021-22945
CVE-2021-22947
CVE-2021-22946
CVE-2021-33193
CVE-2021-38185

The OpenSSL library is updated to version openssl- 1.0.2za.
The Oracle (Sun) JRE and JDK package is updated to version 1.8.0.301.
The Jackson package is updated to version 2.11.4.
The Apache Tomcat server is updated to version 8.5.68.
The Spring package is updated to version 4.3.30.
Eclipse Jetty is updated to version 9.4.43.v20210629.
The Cryptacular library is updated to version 1.2.4.
The XStream library is updated to version 1.4.18.
The urllib3 client is updated to version 1.21.1.
The Common Compress library is updated to version 1.21.
PostgreSQL is updated to version 9.4.26.
The libxml2 library is updated to version 2.9.12.
The c-ares library is updated to version 1.17.1.
cURL is updated to version 7.76.1.

Исправления

Miscellaneous Issues
- You do not receive email notifications for vCenter Server alarms
- vCenter Single Sign-On log files report errors about tomcat-users.xml
- You see warning messages for expiring password even though the account password is set to never expire
- You see an error in method invocation when updating vCenter Server Appliance by using the vCenter Server Appliance Management Interface
- The hostd service might fail during Network File Copy (NFC) operations
- When vSphere Replication is enabled on a virtual machine, many other VMs might become unresponsive
Storage Issues
- Multiple concurrent updates of First Class Disk (FCD) metadata might lead to metadata corruption
- Operations with Cloud Native Storage (CNS) volumes on vCenter Server might fail due to a sync failure
- Blocked FCD operations might delay response to PersistentVolumeClaims
Installation, Upgrade and Migration Issues
- You cannot install a vCenter Server Appliance because the list of networks in the vSphere Client is empty
- Cold migration might fail for virtual machines with size larger than 1 TB
Auto Deploy and Image Builder Issues
- Due to a caching issue, ESXi hosts might fail to boot from Auto Deploy after an upgrade to vCenter Server 6.7 Update 3p
Server Configuration Issues
- Adding ESXi hosts to an Active Directory domain by using the VMware vSphere Authentication Proxy service might fail
- If the NT LAN Manager (NTLM) is disabled on Active Directory, configuration of the vSphere Authentication Proxy service might fail
vSphere HA and Fault Tolerance Issues
- You do not see an alarm when the secondary VM in a vSphere Fault Tolerance (FT) pair cannot power on
Networking Issues
- You cannot remove an ESXi host from а vSphere Distributed Switch (VDS)
- If device backing is not configured in a virtual NIC, the vpxd service might fail while creating a new virtual machine
- You see an error in the vCenter Server network configuration from VAMI after a change to the maximum transmission unit (MTU) to less than 1280 bytes
Virtual Machine Management Issues
- Rare issue with the native snapshot enabled policy of virtual machines might cause the vpxd service to fail with a core dump

Обновление

Имеем VCSA с текущей версией 6.7.0.50000, доступное обновление 6.7.0.51000.

Запустим RUN PRE-UPDATE CHECKS.

Passed. Нажимаем STAGE AND INSTALL — запустится мастер установки обновления.

Ставим галку о принятии лицензионного соглашения. NEXT.

Снимаю галку, NEXT.

Здесь нужно установить галку, что вы не забыли сделать резервную копию vCenter. Ожидаемый простой — 1179 минут. Этой цифре верить нельзя, иногда мне кажется, что там просто генератор случайных чисел стоит. FINISH.