This document tracks the release of 7.0.x patches to the Photon Operating System bundled in VMware vCenter Server.

You can download the deliverables from the Broadcom Support Portal. For download instructions, see Download Broadcom products and software.

Installation Steps

To apply the Photon OS security patches to the vCenter Server Appliance, you can use one of the methods.

  • Deploy a new vCenter Server Appliance by using either the GUI or the CLI installer.

    For information about doing a fresh install of the vCenter Server Appliance, see Deploying the vCenter Server Appliance and Platform Services Controller Appliance.

  • Upgrade to the version of the vCenter Server Appliance containing the latest Photon OS security patches by using either the GUI or the CLI installer.

    For information about upgrading the vCenter Server Appliance, see Upgrading the vCenter Server Appliance.

  • Patch the appliance either by using the appliance shell or the Appliance Management Interface.

    For information on patching the vCenter Server Appliance, see Patching vCenter Server.

  • Perform a file-based backup and restore where in the restore process you deploy a new appliance containing the latest Photon OS security patches..

    For information performing a file-based backup and restore of the vCenter Server Appliance, see Restore vCenter Server from a File-Based Backup.

  • Migrate a vCenter Server on Windows instance to a version of the vCenter Server Appliance containing the latest Photon OS security patches.

    For information about performing a migration of vCenter Server on Windows to vCenter Server Appliance, see Migrating vCenter Server for Windows to vCenter Server Appliance.

vCenter Server Appliance Photon OS Security Patches

vSphere 7.0 Update 2

Release Date

Build Number

Patch Name

Affected Package

New Package Versions

CVEs Addressed

24 August 2021

18356314

vCenter Server 7.0 Update 2c
(Security fixes for Photon OS)

apache-tomcat

8.5.60-2.ph3

CVE-2021-25122

CVE-2021-25329

atftp

0.7.2-2.ph3

CVE-2020-6097

bindutils

9.16.6-2.ph3

CVE-2020-8625

c-ares

1.16.1-1.ph3

CVE-2020-8277

containerd

1.4.4-1.ph3

CVE-2021-21334

dnsmasq

2.82-2.ph3

CVE-2020-25681

CVE-2020-25682

glib

2.58.0-7.ph3

CVE-2021-27218

CVE-2021-27219

glibc

2.28-12.ph3

CVE-2021-3326

gnutls

3.6.15-3.ph3

CVE-2021-20231

grub2

2.06~rc1-1.ph3

CVE-2021-20232

CVE-2020-14372

CVE-2020-25632

CVE-2020-25647

CVE-2020-27749

CVE-2020-27779

CVE-2021-20225

CVE-2021-20233

CVE-2021-3418

linux

4.19.186-3.ph3

CVE-2020-29569

CVE-2020-29661

CVE-2021-3347

CVE-2021-26930

CVE-2021-27365

CVE-2021-28660

CVE-2021-28972

nettle

3.7.2-1.ph3

CVE-2021-20305

nss

3.44-6.ph3

CVE-2020-12403

openldap

2.4.57-2.ph3

CVE-2020-36221

CVE-2020-36222

CVE-2020-36223

CVE-2020-36224

CVE-2020-36225

CVE-2020-36226

CVE-2020-36227

CVE-2020-36228

CVE-2020-36229

CVE-2020-36230

CVE-2021-27212

openssl

1.0.2y-1.ph3

CVE-2021-23839

CVE-2021-23840

runc

1.0.0.rc93-2.ph3

CVE-2021-30465

sudo

1.9.5-3.ph3

CVE-2021-23240

CVE-2021-3156

vSphere 7.0 Update 3

vCenter Server 7.0 Update 3d

Release Date

Build Number

Patch Name

Affected Package

New Package Versions

CVEs Addressed

29 March 2022

19480866

vCenter Server 7.0 Update 3d
(Security fixes for Photon OS)

c-ares

1.16.1-2.ph3

CVE-2021-3672

vim

8.2.3408-4.ph3

CVE-2021-3770
CVE-2021-3778
CVE-2021-3796

httpd

2.4.51-1.ph3

CVE-2021-33193
CVE-2021-34798
CVE-2021-36160
CVE-2021-40438
CVE-2021-39275

apache-tomcat

8.5.60-4.ph3

CVE-2021-41079

openssh

7.8p1-10.ph3

CVE-2021-41617

nettle

3.7.2-2.ph3

CVE-2021-3580

cpio

2.13-4.ph3

CVE-2021-38185

util-linux

2.32.1-4.ph3

CVE-2021-37600

linux

4.19.208-1.ph3

CVE-2020-3702
CVE-2021-22543
CVE-2021-3653
CVE-2021-3656
CVE-2021-42008
CVE-2021-35039
CVE-2021-38160
CVE-2021-45485
CVE-2021-42252

ncurses

6.1-3.ph3

CVE-2021-39537

glibc

2.28-17.ph3

CVE-2021-35942
CVE-2021-38604

atftp

0.7.5-1.ph3

CVE-2021-41054

vCenter Server 7.0 Update 3f

Release Date

Build Number

Patch Name

Affected Package

New Package Versions

CVEs Addressed

12 July 22

20051473

vCenter Server 7.0 Update 3f

apache-tomcat

8.5.72-1.ph3

CVE-2021-42340

bindutils

9.16.27-1.ph3

CVE-2021-25220

containerd

1.4.12-1.ph3

CVE-2022-23648

curl

7.82.0-1.ph3

CVE-2022-22623

 

7.82.0-3.ph3

CVE-2022-22576

cyrus-sasl

2.1.26-17.ph3

CVE-2022-24407

expat

2.2.9-3.ph3

CVE-2022-22822

 

 

CVE-2022-22823

 

 

CVE-2022-22824

 

 

CVE-2022-22825

 

 

CVE-2022-22826

 

 

CVE-2022-22827

 

2.2.9-4.ph3

CVE-2021-45960

 

 

CVE-2021-46143

 

2.2.9-6.ph3

CVE-2022-23852

 

 

CVE-2022-23990

glibc

2.28-18.ph3

CVE-2022-23218

 

 

CVE-2022-23219

httpd

2.4.52-1.ph3

CVE-2021-44790

 

2.4.53-1.ph3

CVE-2022-22719

 

 

CVE-2022-22720

 

 

CVE-2022-22721

 

 

CVE-2022-23943

krb5

1.17-2.ph3

CVE-2020-28196

 

 

CVE-2021-36222

libxml2

2.9.11-6.ph3

CVE-2022-23308

linux

4.19.214-3.ph3

CVE-2021-3760

 

 

CVE-2021-41864

 

4.19.219-3.ph3

CVE-2020-36385

 

4.19.224-1.ph3

CVE-2021-39685

 

 

CVE-2021-39698

 

 

CVE-2021-39713

 

4.19.224-2.ph3

CVE-2022-23222

 

4.19.225-3.ph3

CVE-2022-0330

 

4.19.225-6.ph3

CVE-2022-0435

 

 

CVE-2022-0492

 

4.19.229-1.ph3

CVE-2022-1678

 

4.19.232-1.ph3

CVE-2022-0847

 

 

CVE-2022-27223

lua

5.3.5-3.ph3

CVE-2022-28805

nss

3.44-7.ph3

CVE-2021-43527

openssl

1.0.2zc-2.ph3

CVE-2022-0778

pkg-config

0.29.2-3.ph3

CVE-2020-35457

 

 

CVE-2021-27218

python

3.7.5-17.ph3

CVE-2022-0391

 

3.7.5-18.ph3

CVE-2021-3737

vim

8.2.3408-10.ph3

CVE-2021-4069

 

8.2.3408-12.ph3

CVE-2021-4136

 

8.2.3408-15.ph3

CVE-2021-4187

 

 

CVE-2021-4192

 

 

CVE-2022-0261

 

 

CVE-2022-0318

 

8.2.3408-16.ph3

CVE-2022-0128

 

8.2.3408-18.ph3

CVE-2021-4173

 

 

CVE-2022-0359

 

 

CVE-2022-0361

 

 

CVE-2022-0408

 

8.2.3408-19.ph3

CVE-2022-0392

 

 

CVE-2022-0407

 

 

CVE-2022-0413

 

 

CVE-2022-0443

 

8.2.3408-20.ph3

CVE-2022-0368

 

8.2.3408-22.ph3

CVE-2022-0554

 

 

CVE-2022-0629

 

 

CVE-2022-0685

 

 

CVE-2022-0729

 

8.2.3408-23.ph3

CVE-2022-0572

 

8.2.3408-25.ph3

CVE-2022-0417

 

8.2.3408-5.ph3

CVE-2021-3872

 

8.2.3408-7.ph3

CVE-2021-3973

 

 

CVE-2021-3974

 

8.2.3408-8.ph3

CVE-2021-3903

 

 

CVE-2021-3927

 

 

CVE-2021-3928

 

8.2.3408-9.ph3

CVE-2021-3984

 

 

CVE-2021-4019

 

8.2.4646-1.ph3

CVE-2022-0943

 

 

CVE-2022-1154

 

8.2.4647-1.ph3

CVE-2022-1160

 

8.2.4827-1.ph3

CVE-2022-1381

 

8.2.4925-1.ph3

CVE-2022-1616

 

 

CVE-2022-1619

 

 

CVE-2022-1620

 

 

CVE-2022-1621

 

 

CVE-2022-1629

zlib

1.2.11-2.ph3

CVE-2018-25032


vCenter Server 7.0 Update 3i

Release Date

Build Number

Patch Name

Affected Package

New Package Versions

CVEs Addressed

08 December 2022

20845200

vCenter Server 7.0 Update 3i
(Security fixes for Photon OS)

bindutils

9.16.33-1.ph3

CVE-2022-2795

CVE-2022-3080

CVE-2022-38177

CVE-2022-38178

cifs-utils

6.8-4.ph3

CVE-2022-27239

curl

curl-7.83.1-3.ph3

CVE-2022-27775

CVE-2022-27780

CVE-2022-27781

CVE-2022-27782

expat

2.2.9-10.ph3

CVE-2022-40674

2.2.9-8.ph3

CVE-2022-25314

CVE-2022-25315

glib

2.58.0-9.ph3

CVE-2021-3800

glibc

2.28-22.ph3

CVE-2021-3999

gnutls

3.6.16-3.ph3

CVE-2022-2509

httpd

2.4.54-1.ph3

CVE-2022-26377

CVE-2022-28615

CVE-2022-29404

CVE-2022-30522

CVE-2022-30556

CVE-2022-31813

libarchive

3.3.3-8.ph3

CVE-2021-23177

CVE-2021-31566

libtirpc

1.1.4-2.ph3

CVE-2021-46828

libxml2

2.9.11-8.ph3

CVE-2022-2309

libxslt

1.1.34-1.ph3

CVE-2021-30560

linux

4.19.241-1.ph3

CVE-2022-1055

CVE-2022-28356

4.19.245-1.ph3

CVE-2022-29581

4.19.247-2.ph3

CVE-2022-1966

CVE-2022-32250

CVE-2022-32981

4.19.256-1.ph3

CVE-2021-33656

CVE-2022-36946

lua

5.3.5-4.ph3

CVE-2022-33099

lz4

1.9.2-1.ph3

CVE-2019-17543

1.9.3-2.ph3

CVE-2021-3520

openldap

2.4.57-3.ph3

CVE-2022-29155

openssl

openssl-1.0.2ze-3.ph3

CVE-2022-1292

CVE-2022-2068

postgresql

10.22-1.ph3

CVE-2022-2625

python

3.7.5-21.ph3

CVE-2015-20107

runc

1.1.3-3.ph3

CVE-2022-29162

systemd

239-44.ph3

CVE-2022-2526

vim

vim-8.2.5169-1.ph3

CVE-2022-1733

CVE-2022-1735

CVE-2022-1769

CVE-2022-1785

CVE-2022-1796

CVE-2022-1851

CVE-2022-1886

CVE-2022-1898

CVE-2022-1927

CVE-2022-1942

CVE-2022-2124

CVE-2022-2125

CVE-2022-2126

CVE-2022-2129

CVE-2022-2175

CVE-2022-2182

CVE-2022-2183

CVE-2022-2206

CVE-2022-2207

CVE-2022-2210

zlib

1.2.11-3.ph3

CVE-2022-37434

vCenter Server 7.0 Update 3l

Release Date Build Number Patch Name Affect Package New Package Version CVEs Addressed

30 March 2023

 

 

21477706

 

 

vCenter Server 7.0 Update 3l
(Security fixes for Photon OS)

 apache-ant 1.10.12-1.ph3

CVE-2017-1000487

CVE-2022-24839
binutils 2.32-7.ph3

CVE-2021-45078

CVE-2021-37322

CVE-2018-1000876
curl 7.86.0-3.ph3

CVE-2022-32207   

CVE-2022-22576   

CVE-2022-27782   

CVE-2022-27781    

CVE-2022-27775   

CVE-2021-22946   

CVE-2021-22926   

CVE-2020-8286    

CVE-2020-8285    
grub2 2.06-4.ph3 CVE-2022-2601
linux 4.19.269-3.ph3

CVE-2022-3649

CVE-2022-3643

CVE-2022-42896   

CVE-2022-20568

CVE-2022-2327
pcre 8.44-2.ph3 CVE-2019-20838
ruby  2.5.8-4.ph3

CVE-2020-25613

CVE-2020-10663
samba-client 4.14.14-1.ph3

CVE-2021-23192

CVE-2022-2031

CVE-2022-32744

CVE-2022-32745

 

vCenter Server 7.0 Update 3o

Release Date

Build Number

Patch Name

Affect Package

New Package Version

CVEs Addressed

28 September 2023

22357613

vCenter Server 7.0 Update 3o
(Security fixes for Photon OS)

gnutls

3.6.16-4.ph3

CVE-2023-0361

vim

8.2.5169-5.ph3

CVE-2022-47024

CVE-2023-0049

CVE-2023-0051

CVE-2023-0054

CVE-2023-0433

httpd

2.4.56-1.ph3

CVE-2006-20001

CVE-2022-36760

CVE-2023-25690

CVE-2023-27522

apache-tomcat

8.5.84-2.ph3

CVE-2022-42252

CVE-2022-45143

libtasn1

4.14-2.ph3

CVE-2021-46848

krb5

1.17-4.ph3

CVE-2022-42898

tar

1.30-6.ph3

CVE-2022-48303

sudo

1.9.5-5.ph3

CVE-2023-22809

nss

3.44-9.ph3

CVE-2019-17006

CVE-2020-25648

bindutils

9.16.38-1.ph3

CVE-2022-3736

openssl

1.0.2zg-1.ph3

CVE-2022-4450

CVE-2023-0215

libarchive

3.3.3-9.ph3

CVE-2022-36227

sysstat

12.7.1-1.ph3

CVE-2022-39377

linux

4.19.277-4.ph3

CVE-2023-1281

CVE-2023-26545

CVE-2023-23559

containerd

1.6.8-3.ph3

CVE-2023-25173

libxml2

2.9.11-9.ph3

CVE-2022-40303

CVE-2022-40304

expat

2.2.9-11.ph3

CVE-2020-10735

python3

3.7.5-26.ph3

CVE-2020-10735

CVE-2022-37454

CVE-2022-45061

dnsmasq

2.85-3.ph3

CVE-2022-0934

pkg-config

0.29.2-4.ph3

CVE-2021-3800

curl

7.86.0-5.ph3

CVE-2023-23914

CVE-2023-23916

CVE-2023-27535

CVE-2023-27536

e2fsprogs

1.46.5-2.ph3

CVE-2022-1304

vCenter Server 7.0 Update 3q

Release Date Build Number Patch Name Affect Package New Package Version CVEs Addressed
21 May 2024 23788036 vCenter Server 7.0 Update 3q
(Security fixes for Photon OS)		 apache-tomcat 8.5.88-2.ph3

CVE-2023-28709
apr-util 1.6.1-5.ph3

CVE-2022-25147
bindutils 9.16.42-3.ph3

CVE-2023-3341
CVE-2023-2829
CVE-2023-2828

CVE-2023-2911
c-ares 1.19.1-1.ph3

CVE-2023-32067
cloud-init 22.4.2-5.ph3 CVE-2023-1786
curl 8.1.2-4.ph3

CVE-2023-38039
CVE-2023-38545

CVE-2023-38456
dmidecode 3.5-1.ph3

CVE-2023-30630
dnsmasq 2.85-4.ph3

CVE-2023-28450
elfutils 0.176-3.ph3

CVE-2021-33294
CVE-2020-21047
freetype2 2.9.1-5.ph3 CVE-2023-2004
gawk 4.2.1-2.ph3 CVE-2023-4156
gdb 10.1-5.ph3

CVE-2018-25032
CVE-2021-3549

CVE-2022-38533

CVE-2022-4285
CVE-2023-1972

CVE-2023-25584

CVE-2023-25585

CVE-2023-25588
glibc 2.28-24.ph3 CVE-2023-4813
grub2 2.06-9.ph3

CVE-2023-4692

CVE-2023-4693
CVE-2022-28736
CVE-2021-3697
httpd 2.4.58-1.ph3

CVE-2023-31122
krb5 1.17-5.ph3

CVE-2023-36054
libldb 2.6.2-1.ph3 CVE-2023-0614
libssh2 1.9.0-3.ph3

CVE-2020-22218
libuv 1.34.2-3.ph3 CVE-2020-8252
libxml2 2.9.11-11.ph3

CVE-2023-29469

CVE-2023-28484
CVE-2023-45322
linux 4.19.297-1.ph3

CVE-2023-1611
CVE-2023-1076

CVE-2023-1077
CVE-2021-3759
CVE-2023-2124
CVE-2023-4128
CVE-2023-2007
CVE-2023-42753
CVE-2023-42754
nss 3.44-11.ph3

CVE-2022-36320

CVE-2019-11729
CVE-2019-11745
ntp 4.2.8p16-1.ph3

CVE-2023-26551

CVE-2023-26555
open-vm-tools 12.2.0-5.ph3

CVE-2023-20867
CVE-2023-20900
CVE-2023-34058

CVE-2023-34059
openldap 2.4.57-4.ph3 CVE-2023-2953
openssh 7.8p1-17.ph3

CVE-2023-38408
CVE-2023-51385
perl 5.28.0-8.ph3

CVE-2023-31486
postgresql13 13.13-1.ph3

CVE-2023-2454

CVE-2023-2455
procps-ng 3.3.15-4.ph3 CVE-2023-4016
python3 3.7.5-32.ph3

CVE-2023-24329
CVE-2022-48565

CVE-2022-48566

CVE-2022-48560

CVE-2022-48564
CVE-2007-4559
CVE-2023-40217
runc 1.1.4-9.ph3

CVE-2023-27561
CVE-2023-25809
samba-client 4.17.12-1.ph3 CVE-2023-3961
shadow 4.6-7.ph3

CVE-2023-29383
sqlite 3.35.5-2.ph3

CVE-2021-31239
systemd 239-51.ph3

CVE-2023-26604
CVE-2023-26604
tcpdump 4.99.4-1.ph3 CVE-2020-8036
traceroute 2.1.3-1.ph3

CVE-2023-46316
unzip 6.0-18.ph3

CVE-2022-0529

CVE-2022-0530
vim 8.2.5169-14.ph3

CVE-2023-1264

CVE-2023-1175

CVE-2023-1170

CVE-2022-3352
CVE-2022-3256

CVE-2022-3235

CVE-2022-4141

CVE-2022-3099
CVE-2022-2874

CVE-2022-2343

CVE-2022-3134

CVE-2022-2849
CVE-2022-2285

CVE-2022-3234

CVE-2022-3297

CVE-2022-2286
CVE-2022-2345

CVE-2022-2581

CVE-2022-2522

CVE-2022-2889

CVE-2022-3296

CVE-2022-2598

CVE-2022-2982

CVE-2022-2845
CVE-2022-2571

CVE-2022-3016

CVE-2022-2289

CVE-2022-2344
CVE-2022-3037

CVE-2022-2287

CVE-2022-2257

CVE-2022-2284
CVE-2022-2264,

CVE-2022-2980

CVE-2022-2817

CVE-2022-2580

CVE-2022-2288

CVE-2022-2816

CVE-2022-2862

CVE-2022-2923
CVE-2022-2304

CVE-2022-3491

CVE-2022-4293

CVE-2022-3705
CVE-2022-3153

CVE-2022-3278
CVE-2023-2426
CVE-2023-2610
CVE-2023-2609
CVE-2023-5344

CVE-2023-5441

CVE-2023-5535
CVE-2023-46246
xerces-c 3.2.4-1.ph3 CVE-2012-0880
xinetd 2.3.15-10.ph3 CVE-2013-4342
zlib 1.2.11-5.ph3

CVE-2023-45853



python3-certifi 2023.11.17-1

CVE-2023-37920
check-circle-line exclamation-circle-line close-line
Scroll to top icon