VMware ESXi, Workstation

[igonzalez]

Continuing the discussion from Discovery scan as a port scan?:

A vulnerability came out Mware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities (CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255) and I don’t see the CVEs appearing in Greenbone and not if my endpoints are affected.

[cfi]

Please see the following here about the time frame once such CVEs (which have been recently published) are ending up in the SecInfo part of the GSA:

CVE-2023-6933 seems to be missingmissing

This info is btw. also included in the documentation here: The availability of a CVE on the appliance depends on its availability in the NVD. As soon as it has been published there, it takes 1–2 working days for it to appear in the SecInfo. 14 Managing SecInfo — Greenbone Enterprise Appliance 22.04.17 documentation

VTs for such CVEs are not magically / automatically created and such VTs needs to be manually created, thus they also won’t show up immediately / there could be a delay of at least 1-2 working days.

For this specific case a VT for VMware ESXi has been already created and will available in the enterprise feed today (it won’t be available for the community feed).

For Workstation and Fusion there is no ETA for the creation of VTs, the tasks is currently in the hand of the responsible team working on the coverage of these products.