VMware Aria Automation (formerly vRealize Automation)

On April 21, 2022, VMware released the April 2022 Cumulative Security update for vRealize Automation 7.6 and vRealize Orchestrator 7.6. This update includes patches for various platform components that may be flagged by vulnerability scanners while scanning the virtual appliances. Since this update is cumulative, all previously updated components are included in this release. What’s Included While VMware does not provide detailed release notes for these cumulative security updates, based on the contents of the update script, the following RPM packages will be deployed during the update process:

VMware has released the latest update to the vRealize Suite, vRealize Automation 8.7, on March 22, 2022. With this release, VMware has provided several enhancements and new features, including a next-generation On-Prem ABX Engine, enhancements to vRealize Automation SaltStack Config, additional OS support for SaltStack Config SecOps Compliance, minor UI changes, and several changes related to deployments. What’s New Updates included in vRealize Automation 8.7.0: Next-generation On-Prem ABX Engine - New Function as a Service (FaaS) engine is much faster, fixes numerous issues with memory limits, and introduces memory-based throttling.

For several years, VMware has been adding new integration capabilities into new releases of VMware Tools. These capabilities often supported VMware products, including vRealize Operations, NSX, AppDefence, and Carbon Black. The latest product to be integrated into VMware Tools 12.0.0 is VMware vRealize SaltStack Config. VMware Tools 12.0.0 now includes the ability to automate the deployment of the Salt Minion software utilizing vSphere virtual machine guest variables. This new integration makes it easier than ever to deploy new Salt Minions to both new and existing virtual machines.

VMware has been quite busy providing workarounds for all of their products that are affected by the recent Apache Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. One of the affected products is vRealize Automation 8.0 through 8.6.1. While VMware has stated that these vulnerabilities will be addressed in the future vRealize Automation 8.6.2 and vRealize Orchestrator 8.6.2 releases, they have provided a temporary workaround as detailed in KB87120 for vRealize Automation and vRealize Orchestrator versions 8.

Unless you’ve been living under a rock the past couple days, you’ve likely been seeing many articles regarding CVE-2021-44228 which describes a remote code execution vulnerability within Apache Log4j. Apache Log4j is a Java-based logging utility used by many applications across the world, and as such, this vulnerability is a huge issue due to how easy it is to exploit as well as the sheer number of vulnerable devices. Like most companies with Java based applications, many of VMware’s products utilize Log4j to provide application logging capabilities.