Skip to content
Fencer Vulns
high 7.1

CVE-2023-34058 json

VMware Tools contains a SAML token signature bypass vulnerability.

published 2023-10-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-38172

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

Patch / fix

  • vmware tools 12.3.5
  • open-vm-tools Debian 12 2:12.2.0-1+deb12u2
  • open-vm-tools Debian 14, Debian 13 2:12.3.5-1

debian advisories DEBIAN-CVE-2023-34058

  • open-vm-tools Ubuntu 20.04 LTS 2:11.3.0-2ubuntu0~ubuntu20.04.7
  • open-vm-tools Ubuntu 22.04 LTS 2:12.1.5-3~ubuntu0.22.04.4
  • open-vm-tools Ubuntu Pro 16.04 LTS 2:10.2.0-3~ubuntu0.16.04.1+esm4
  • open-vm-tools Ubuntu Pro 18.04 LTS 2:11.0.5-4ubuntu0.18.04.3+esm3

ubuntu advisories UBUNTU-CVE-2023-34058

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • open-vm-tools RHEL 7 11.0.5-3.el7_9.9
  • open-vm-tools-test RHEL 7 11.0.5-3.el7_9.9
  • open-vm-tools-desktop RHEL 7 11.0.5-3.el7_9.9
  • open-vm-tools RHEL 9 12.2.5-3.el9_3.2
  • open-vm-tools-sdmp RHEL 9 12.2.5-3.el9_3.2
  • open-vm-tools-test RHEL 9 12.2.5-3.el9_3.2
  • open-vm-tools-desktop RHEL 9 12.2.5-3.el9_3.2
  • open-vm-tools-salt-minion RHEL 9 12.2.5-3.el9_3.2

red hat advisories RHSA-2023:7267RHSA-2023:7279RHSA-2023:7261RHSA-2023:7277RHSA-2023:7262RHSA-2023:7260

  • open-vm-tools SLES for SAP 12 SP5, SLES 12 SP5 12.3.0-4.62.1
  • open-vm-tools SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Desktop Applications 15 SP5 +17 more 12.3.0-150300.43.1
  • open-vm-tools SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 11.3.5-150100.4.37.21.1
  • open-vm-tools SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS 11.3.5-150200.5.16.19.1

suse advisories SUSE-SU-2023:4230-1SUSE-SU-2023:4229-1SUSE-SU-2023:4228-1SUSE-SU-2023:4227-1

  • open-vm-tools openSUSE Tumbleweed 12.3.0-5.1

opensuse advisories openSUSE-SU-2024:13374-1

  • open-vm-tools AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
  • open-vm-tools-sdmp AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
  • open-vm-tools-desktop AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
  • open-vm-tools-salt-minion AlmaLinux 8 12.2.5-3.el8_9.1.alma.1
  • open-vm-tools AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
  • open-vm-tools-sdmp AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
  • open-vm-tools-test AlmaLinux 9 12.2.5-3.el9_3.2.alma.1
  • open-vm-tools-desktop AlmaLinux 9 12.2.5-3.el9_3.2.alma.1

almalinux advisories ALSA-2023:7265ALSA-2023:7277

  • open-vm-tools Rocky Linux 8 12.2.5-3.el8_9.1

rocky linux advisories RLSA-2023:7265

  • open-vm-tools CBL-Mariner 2.0 11.3.0-3

azure linux advisories AZL-31718

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-34058 updated cvss 7.5

open-vm-tools: SAML token signature bypass

  • Red Hat Enterprise Linux AppStream (v. 8) open-vm-tools 12.2.5-3.el8_9.1, open-vm-tools-sdmp 12.2.5-3.el8_9.1, open-vm-tools-desktop 12.2.5-3.el8_9.1, open-vm-tools-salt-minion 12.2.5-3.el8_9.1
    fixed: vendor fix RHSA-2023:7265
  • Red Hat Enterprise Linux AppStream (v. 9) open-vm-tools 12.2.5-3.el9_3.2, open-vm-tools-sdmp 12.2.5-3.el9_3.2, open-vm-tools-test 12.2.5-3.el9_3.2, open-vm-tools-desktop 12.2.5-3.el9_3.2, open-vm-tools-salt-minion 12.2.5-3.el9_3.2
    fixed: vendor fix RHSA-2023:7277
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.4, open-vm-tools-desktop 11.0.0-4.el8_2.4
    fixed: vendor fix RHSA-2023:7261
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.4, open-vm-tools-sdmp 11.2.0-2.el8_4.4, open-vm-tools-desktop 11.2.0-2.el8_4.4
    fixed: vendor fix RHSA-2023:7262
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) open-vm-tools 10.3.10-3.el8_1.5, open-vm-tools-desktop 10.3.10-3.el8_1.5
    fixed: vendor fix RHSA-2023:7260
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) open-vm-tools 11.0.0-4.el8_2.4, open-vm-tools-desktop 11.0.0-4.el8_2.4
    fixed: vendor fix RHSA-2023:7261
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) open-vm-tools 11.2.0-2.el8_4.4, open-vm-tools-sdmp 11.2.0-2.el8_4.4, open-vm-tools-desktop 11.2.0-2.el8_4.4
    fixed: vendor fix RHSA-2023:7262
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) open-vm-tools 11.3.5-1.el8_6.5, open-vm-tools-sdmp 11.3.5-1.el8_6.5, open-vm-tools-desktop 11.3.5-1.el8_6.5
    fixed: vendor fix RHSA-2023:7263
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) open-vm-tools 12.1.5-2.el8_8.4, open-vm-tools-sdmp 12.1.5-2.el8_8.4, open-vm-tools-desktop 12.1.5-2.el8_8.4, open-vm-tools-salt-minion 12.1.5-2.el8_8.4
    fixed: vendor fix RHSA-2023:7264
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) open-vm-tools 11.3.5-1.el9_0.5, open-vm-tools-sdmp 11.3.5-1.el9_0.5, open-vm-tools-test 11.3.5-1.el9_0.5, open-vm-tools-desktop 11.3.5-1.el9_0.5
    fixed: vendor fix RHSA-2023:7267
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) open-vm-tools 12.1.5-1.el9_2.4, open-vm-tools-sdmp 12.1.5-1.el9_2.4, open-vm-tools-test 12.1.5-1.el9_2.4, open-vm-tools-desktop 12.1.5-1.el9_2.4, open-vm-tools-salt-minion 12.1.5-1.el9_2.4
    fixed: vendor fix RHSA-2023:7276
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) open-vm-tools 11.0.0-4.el8_2.4, open-vm-tools-desktop 11.0.0-4.el8_2.4
    fixed: vendor fix RHSA-2023:7261
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) open-vm-tools 11.2.0-2.el8_4.4, open-vm-tools-sdmp 11.2.0-2.el8_4.4, open-vm-tools-desktop 11.2.0-2.el8_4.4
    fixed: vendor fix RHSA-2023:7262
  • Red Hat Enterprise Linux Client (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Client Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Server (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Server Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9 Red Hat Enterprise Linux Workstation (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9
    +1 more products
    Red Hat Enterprise Linux Workstation Optional (v. 7) open-vm-tools 11.0.5-3.el7_9.9, open-vm-tools-test 11.0.5-3.el7_9.9, open-vm-tools-desktop 11.0.5-3.el7_9.9
    fixed: vendor fix RHSA-2023:7279

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • n/a VMware Tools
  • n/a open-vm-tools

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.