| Package | Affected versions | Patched versions |
|---|---|---|
| isolation segment | ≥ 2.11.0, < 2.11.35≥ 2.13.0, < 2.13.20≥ 3.0.0, < 3.0.13≥ 4.0.0, < 4.0.4 | 2.11.352.13.203.0.134.0.4 |
| tanzu application service for virtual machines | ≥ 2.11.0, < 2.11.42≥ 2.13.0, < 2.13.24≥ 3.0.0, < 3.0.14≥ 4.0.0, < 4.0.5 | 2.11.422.13.243.0.144.0.5 |
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free