-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -----------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2017-0019
Severity: Moderate
Synopsis: NSX for vSphere update addresses NSX Edge Cross-Site
Scripting (XSS) issue.
Issue date: 2017-11-16
Updated on: 2017-11-16 (Initial Advisory)
CVE number: CVE-2017-4929
1. Summary
NSX for vSphere update addresses NSX Edge Cross-Site
Scripting (XSS) issue.
2. Relevant Products
NSX for vSphere
3. Problem Description
a. NSX Edge Cross-Site Scripting (XSS) issue.
NSX Edge contains a moderate Cross-Site Scripting (XSS) issue
which may lead to information disclosure.
VMware would like to thank Jarad Kopf of Deltek and Issam Rabhi for
independently reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2017-4929 to this issue.
Column 5 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/ Mitigation
Product Version on Severity Apply patch Workaround
============== ======= ======= ======== ============= ==========
NSX Edge 6.2.x Any Moderate 6.2.9 None
NSX Edge 6.3.x Any Moderate 6.3.5 None
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
VMware NSX for vSphere 6.2.9
Downloads:
https://my.vmware.com/web/vmware/details?productId=417
&downloadGroup=NSXV_629B
Documentation:
https://docs.vmware.com/en/VMware-NSX-for-vSphere/index.html
VMware NSX for vSphere 6.3.5
Downloads: XXXXXX
https://my.vmware.com/web/vmware/details?productId=417
&downloadGroup=NSXV_635
Documentation:
https://docs.vmware.com/en/VMware-NSX-for-vSphere/index.html
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4929
- - ------------------------------------------------------------------------
6. Change log
2017-11-16 VMSA-2017-0019
Initial security advisory in conjunction with the release of VMware
NSX for vSphere 6.3.5 on 2017-11-16
- - ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
[email protected]
[email protected]
[email protected]
E-mail: [email protected]
PGP key at: https://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Twitter
https://twitter.com/VMwareSRC
Copyright 2017 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.4.1 (Build 490)
Charset: utf-8
wj8DBQFaDmf+DEcm8Vbi9kMRAu+tAJ9XIf+FCqxO+v6L7jtm44us7xetlACfTJrr
8rMXdzg5zxxkszWTifTfb0o=
=1BY4
-----END PGP SIGNATURE-----
_______________________________________________
Security-announce mailing list
[email protected]
https://lists.vmware.com/mailman/listinfo/security-announce
