vRealize Operations 8.6.4
Article ID: 337329
Updated On:
Products
VMware Aria Suite
Issue/Introduction
vRealize Operations 8.6.4 is a public maintenance release of vRealize Operations in which issues related to performance and stability have been fixed.
The following issues have been resolved as of vRealize Operations 8.6.4:
The following CVEs have been resolved as of vRealize Operations 8.6.4:
The following issues have been resolved as of vRealize Operations 8.6.4:
- Service Discovery in Japanese locale windows machine failing.
- Tomcat Server & Gateway Security should show up with the right icons under Application Monitoring.
- Metric and Attribute searches work using different logic. Make this experience consistent throughout the entities.
- Failed to query data for "vSAN Overview" on vCenter plugin, FS enabled.
- Telegraf agent not working as expected.
- Potential XXE On platform api.
- Potential XXE On platform Controller.
- Potential XXE on Content.
- Unable to monitor Oracle database using Telegraf Agent.
- VMC on AWS adapter missed collecting a few subscriptions.
- "ARC adapters status is warning for FIPS enabled setups".
- FIPS enabled setups have intermittent issues while connecting CP to setup.
- Analytics' service has been restarted by oom-killer.
- "Preference" time is incorrect, when loging into vRealize Operations using vIDM.
- Take cluster offline when /storage/log OR /storage/db partitions is filled more than 98%.
- vRA collection fails with 'com.vmware.adapter3.cas.CASAdapter.onCollect : Forced timeout after 3600 SECONDS'.
- Summary dashboard for VM objects not loading/not displaying correctly.
- NPE on Test connection of LDAP server, configured through admin UI.
- Monitoring windows services with underscore using Open source telegraf does not show complete servicename.
- Content Management: REST API: Downloaded zip file is invalid/corrupted.
- Import of Notification rule via API : all Notifications disappear from the GUI view (Configuration > Alerts > Notifications).
- Node addition fails on vRealize Operations 8.6.x cluster that was upgraded to HF.
- Flashing "Please wait..." overlay is preventing UI access.
- Service Monitoring for Windows has a gap in metric collection after every 6 collection cycles.
- Timeout while trying to Rebalance (getShardBalancingScheme).
- Problem collecting from large vSAN environments.
The following CVEs have been resolved as of vRealize Operations 8.6.4:
| Component Name | CVE | Fixed in |
|---|---|---|
| vRealize Operations Application | CVE-2022-31672 | vRealize Operations |
| CVE-2022-31673 | vRealize Operations | |
| CVE-2022-31674 | vRealize Operations | |
| CVE-2022-31675 | vRealize Operations | |
| apache | CVE-2022-29404 | vRealize Operations, Cloud Proxy |
| CVE-2022-28614 | vRealize Operations, Cloud Proxy | |
| CVE-2022-30556 | vRealize Operations, Cloud Proxy | |
| CVE-2022-30522 | vRealize Operations, Cloud Proxy | |
| CVE-2022-31813 | vRealize Operations, Cloud Proxy | |
| CVE-2022-26377 | vRealize Operations, Cloud Proxy | |
| CVE-2022-28330 | vRealize Operations, Cloud Proxy | |
| CVE-2022-28615 | vRealize Operations, Cloud Proxy | |
| batik | CVE-2019-17566 | vRealize Operations |
| cifs-utils | CVE-2022-27239 | vRealize Operations, Cloud Proxy |
| CVE-2022-29869 | vRealize Operations, Cloud Proxy | |
| containerd | CVE-2022-23648 | Cloud Proxy |
| curl | CVE-2022-27779 | vRealize Operations, Cloud Proxy |
| CVE-2022-27780 | vRealize Operations, Cloud Proxy | |
| CVE-2022-30115 | vRealize Operations, Cloud Proxy | |
| glibc | CVE-2021-35942 | Cloud Proxy |
| CVE-2021-38604 | Cloud Proxy | |
| CVE-2021-43396 | Cloud Proxy | |
| CVE-2022-23218 | Cloud Proxy | |
| CVE-2022-23219 | Cloud Proxy | |
| gson | CVE-2022-25647 | vRealize Operations |
| jackson-databind | CVE-2020-36518 | Cloud Proxy |
| libgcrypt | CVE-2021-40528 | Cloud Proxy |
| libsolv | CVE-2021-33928 | Cloud Proxy |
| CVE-2021-33929 | Cloud Proxy | |
| CVE-2021-33930 | Cloud Proxy | |
| CVE-2021-33938 | Cloud Proxy | |
| CVE-2021-44568 | Cloud Proxy | |
| libxslt | CVE-2021-30560 | vRealize Operations, Cloud Proxy |
| CVE-2022-29824 | vRealize Operations, Cloud Proxy | |
| linux_kernel | CVE-2022-28356 | vRealize Operations, Cloud Proxy |
| CVE-2022-1055 | vRealize Operations, Cloud Proxy | |
| CVE-2022-0494 | vRealize Operations, Cloud Proxy | |
| CVE-2021-4149 | vRealize Operations, Cloud Proxy | |
| CVE-2021-4197 | vRealize Operations, Cloud Proxy | |
| CVE-2022-0854 | vRealize Operations, Cloud Proxy | |
| CVE-2022-27666 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1011 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23960 | vRealize Operations, Cloud Proxy | |
| CVE-2021-26401 | vRealize Operations, Cloud Proxy | |
| CVE-2022-0001 | vRealize Operations, Cloud Proxy | |
| CVE-2022-0002 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23036 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23037 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23038 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23039 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23040 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23041 | vRealize Operations, Cloud Proxy | |
| CVE-2022-23042 | vRealize Operations, Cloud Proxy | |
| CVE-2022-24958 | vRealize Operations, Cloud Proxy | |
| CVE-2022-33981 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1998 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1966 | vRealize Operations, Cloud Proxy | |
| CVE-2022-32250 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1652 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1786 | vRealize Operations, Cloud Proxy | |
| CVE-2022-29581 | vRealize Operations, Cloud Proxy | |
| CVE-2022-30594 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1353 | vRealize Operations, Cloud Proxy | |
| log4j | CVE-2021-44832 | Cloud Proxy |
| mongoose | CVE-2022-2564 | vRealize Operations |
| nss | CVE-2021-43527 | Cloud Proxy |
| openldap | CVE-2022-29155 | vRealize Operations, Cloud Proxy |
| postgresql | CVE-2022-24844 | vRealize Operations |
| CVE-2021-23214 | vRealize Operations | |
| runc | CVE-2022-29162 | Cloud Proxy |
| CVE-2022-24769 | Cloud Proxy | |
| spring_framework | CVE-2022-22968 | Cloud Proxy |
| CVE-2022-22950 | Cloud Proxy | |
| CVE-2022-22965 | Cloud Proxy | |
| CVE-2020-5421 | Cloud Proxy | |
| CVE-2022-22970 | Cloud Proxy | |
| spring-security-core | CVE-2022-22976 | vRealize Operations, Cloud Proxy |
| CVE-2022-22978 | vRealize Operations, Cloud Proxy | |
| spring-security-web | CVE-2022-22976 | vRealize Operations, Cloud Proxy |
| CVE-2022-22978 | vRealize Operations, Cloud Proxy | |
| struts | CVE-2020-17530 | vRealize Operations, Cloud Proxy |
| CVE-2021-31805 | vRealize Operations, Cloud Proxy | |
| tomcat | CVE-2022-29885 | Cloud Proxy |
| toybox | CVE-2022-32298 | Cloud Proxy |
| vim | CVE-2022-2210 | vRealize Operations, Cloud Proxy |
| CVE-2022-2208 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2207 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1619 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1927 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2129 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2126 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2125 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2124 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1720 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2175 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2183 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2182 | vRealize Operations, Cloud Proxy | |
| CVE-2022-2206 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1616 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1420 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1381 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1851 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1886 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1898 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1942 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1620 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1733 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1771 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1785 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1796 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1769 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1735 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1674 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1629 | vRealize Operations, Cloud Proxy | |
| CVE-2022-1621 | vRealize Operations, Cloud Proxy | |
| xstream | CVE-2021-43859 | vRealize Operations |
Environment
VMware vRealize Operations 8.6.x
Resolution
vRealize Operations 8.6.4 can be applied to any 8.0.x - 8.6.x environment.
It is recommended to take snapshots following How to take a Snapshot of vRealize Operations before upgrading.
It is recommended to take snapshots following How to take a Snapshot of vRealize Operations before upgrading.
- Download the vRealize Operations 8.6.4 upgrade PAK file from VMware Downloads.
- Log in to the master node vRealize Operations Administrator interface of your cluster at https://master-node-FQDN-or-IP-address/admin.
- Click Software Update in the left panel.
- Click Install a Software Update in the main panel.
- Follow the steps in the wizard to locate and install your PAK file.
- Install the product update PAK file.
Wait for the software update to complete. When it does, the Administrator interface logs you out. - Log back into the master node Administrator interface.
The main Cluster Status page appears and cluster goes online automatically. The status page also displays the Bring Online button, but do not click it.
- Clear the browser caches and if the browser page does not refresh automatically, refresh the page.
The cluster status changes to Going Online. When the cluster status changes to Online, the upgrade is complete.
Note: If a cluster fails and the status changes to offline during the installation process of a PAK file update then some nodes become unavailable. To fix this, you can access the Administrator interface and manually take the cluster offline and click Finish Installation to continue the installation process.
- Click Software Update to check that the update is done.
A message indicating that the update completed successfully appears in the main pane.
Additional Information
Once the update is complete, delete the snapshots you made before the software update.
Note: Some security scanner utilities may report on geode-log4j-1.12.0.jar as being impacted by CVE-2019-17571; this is a false positive and can safely be ignored.
The vulnerable class name in CVE-2019-17571 is SocketServer, where as the geode-log4j-1.12.0.jar jar file does not contain any class with SocketServer name.
Note: Some security scanner utilities may report on geode-log4j-1.12.0.jar as being impacted by CVE-2019-17571; this is a false positive and can safely be ignored.
The vulnerable class name in CVE-2019-17571 is SocketServer, where as the geode-log4j-1.12.0.jar jar file does not contain any class with SocketServer name.
Feedback
Yes
No
Powered by
