In late February, VMware published their second security advisory for 2021. It contained contained three items:
- CVE-2021-21972 – A remote code execution vulnerability in vCenter that has a CVSS score of 9.8
- CVE-2021-21974 – A vulnerablity in OpenSLP, which is used in ESXi. This one has a CVSS score of 8.8
- CVE-2021-21973 – Another vCenter vulnerability that was rated with a CVSS score of 5.3
Given the product versions affected, most organisations with relatively up to date virtualisation infrastructure would be at risk from these items. While testing and simulating the update process, I ran into some issues that might be worth publishing for a broader audience.