VMware Identity Manager
Hot on the heels of the recent April 2022 VMware critical security advisory VMSA-2022-0011, which addressed eight CVEs within VMware Workspace ONE Access and VMware Identity Manager, VMware has released a new creitical security advisory VMSA-2022-0014. This advisory addresses two new security vulnerabilities (CVE-2022-22972 and CVE-2022-22973) in VMware Workspace ONE Access and VMware Identity Manager, with one rated as critical. Authentication Bypass Vulnerability - CVE-2022-22972 According to VMware, a malicious user with network access to the VMware Workspace ONE Access or VMware Identity Manager user interfaces may be able to obtain administrative access without needing to authenticate.
Those familiar with deploying VMware vRealize Suite know just how vital VMware Identity Manager (vIDM) is to support the entire deployment. For those who haven’t deployed VMware vRealize Suite, VMware Identity Manager is the centralized authentication platform integrated throughout the entire VMware vRealize Suite of products. It provides multiple directory options, including Active Directory Integrated Windows Authentication, Active Directory over LDAPS, traditional LDAP directories, and local directories. Authentication options include traditional username/password, x509 certificate/smart card, Kerberos, RSA Adaptive Authentication, RSA SecurID, and RADIUS.
Unless you’ve been living under a rock the past couple days, you’ve likely been seeing many articles regarding CVE-2021-44228 which describes a remote code execution vulnerability within Apache Log4j. Apache Log4j is a Java-based logging utility used by many applications across the world, and as such, this vulnerability is a huge issue due to how easy it is to exploit as well as the sheer number of vulnerable devices. Like most companies with Java based applications, many of VMware’s products utilize Log4j to provide application logging capabilities.
I recently had the pleasure of upgrading two virtual appliance-based VMware Identity Manager 3.3.0 deployments to 3.3.1 using the offline update method without the assistance of vRealize Suite Lifecycle Manager. When I reviewed the update documentation, I found that this release didn’t support the offline update process I previously utilized, so I figured I’d create a quick post providing an overview of the supported update processes for 3.3.1. What Changed? In previous releases of VMware Identity Manager 3.
The latest release of vRealize Automation 8.0 is based on a completely rewritten codebase and is a dramatic departure from the previous versions of vRealize Automation. vRealize Automation 8.0 is an on-premise release of the VMware vRealize Automation Cloud SaaS offering that has been available for a while now. The platform consists of 3 components: Cloud Assembly, Cloud Broker, and Code Stream. The new vRealize Automation 8.0 virtual appliance includes these components as well as an integrated version of vRealize Orchestrator 8.