# CVE-2023-34058: open-vm-tools: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted  Guest Ope...

CVE-2023-34058 is fixed in 12 products on 1 platform, first by open-vm-tools 2:11.0.5-4ubuntu0.18.04.3+esm3, released October 25, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-34058
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0081
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 25, 2023

## Description

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | open-vm-tools Debian 11.6 (bullseye) | 2:11.2.5-2+deb11u3 | [DSA-5543-1](https://patchblox.com/security/data/fix/linux/dsa-5543-1.md) | Oct 31, 2023 |
| Linux | open-vm-tools Debian 12.15 (bookworm) | 2:12.2.0-1+deb12u2 | [DSA-5543-1](https://patchblox.com/security/data/fix/linux/dsa-5543-1.md) | Oct 31, 2023 |
| Linux | open-vm-tools Debian 13.5 (trixie) | 2:12.3.5-1 | [DEBIAN-CVE-2023-34058](https://patchblox.com/security/data/fix/linux/debian-cve-2023-34058.md) | Oct 27, 2023 |
| Linux | open-vm-tools Debian 14 | 2:12.3.5-1 | [DEBIAN-CVE-2023-34058](https://patchblox.com/security/data/fix/linux/debian-cve-2023-34058.md) | Oct 27, 2023 |
| Linux | open-vm-tools RHEL 8 | 0:12.2.5-3.el8_9.1 | [RHSA-2023:7265](https://patchblox.com/security/data/fix/linux/rhsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools RHEL 9 | 0:12.2.5-3.el9_3.2 | [RHSA-2023:7277](https://patchblox.com/security/data/fix/linux/rhsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools Ubuntu 18.04.6 LTS (bionic) | 2:11.0.5-4ubuntu0.18.04.3+esm3 | [open-vm-tools 2:11.0.5-4ubuntu0.18.04.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-open-vm-tools-2-11.0.5-4ubuntu0.18.04.3-esm3.md) | Oct 25, 2023 |
| Linux | open-vm-tools Ubuntu 20.04 LTS (focal) | 2:11.3.0-2ubuntu0~ubuntu20.04.7 | [open-vm-tools 2:11.3.0-2ubuntu0~ubuntu20.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-open-vm-tools-2-11.3.0-2ubuntu0-ubuntu20.04.7.md) | Oct 25, 2023 |
| Linux | open-vm-tools Ubuntu 22.04.1 LTS (jammy) | 2:12.1.5-3~ubuntu0.22.04.4 | [open-vm-tools 2:12.1.5-3~ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-open-vm-tools-2-12.1.5-3-ubuntu0.22.04.4.md) | Oct 25, 2023 |
| Linux | open-vm-tools almalinux 8 | 12.2.5-3.el8_9.1.alma.1 | [ALSA-2023:7265](https://patchblox.com/security/data/fix/linux/alsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools almalinux 9 | 12.2.5-3.el9_3.2.alma.1 | [ALSA-2023:7277](https://patchblox.com/security/data/fix/linux/alsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools ol 8 | 0:12.2.5-3.0.1.el8_9.1 | [ELSA-2023-7265](https://patchblox.com/security/data/fix/linux/elsa-2023-7265.md) | Nov 21, 2023 |
| Linux | open-vm-tools ol 9 | 0:12.2.5-3.0.1.el9_3.2 | [ELSA-2023-7277](https://patchblox.com/security/data/fix/linux/elsa-2023-7277.md) | Nov 16, 2023 |
| Linux | open-vm-tools rocky 8 | 0:12.2.5-3.el8_9.1 | [RLSA-2023:7265](https://patchblox.com/security/data/fix/linux/rlsa-2023-7265.md) | Nov 28, 2023 |
| Linux | open-vm-tools-containerinfo Ubuntu 22.04.1 LTS (jammy) | 2:12.1.5-3~ubuntu0.22.04.4 | [open-vm-tools-containerinfo 2:12.1.5-3~ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-open-vm-tools-containerinfo-2-12.1.5-3-ubuntu0.22.04.4.md) | Oct 25, 2023 |
| Linux | open-vm-tools-debuginfo amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-debugsource amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-desktop RHEL 8 | 0:12.2.5-3.el8_9.1 | [RHSA-2023:7265](https://patchblox.com/security/data/fix/linux/rhsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools-desktop RHEL 9 | 0:12.2.5-3.el9_3.2 | [RHSA-2023:7277](https://patchblox.com/security/data/fix/linux/rhsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-desktop Ubuntu 18.04.6 LTS (bionic) | 2:11.0.5-4ubuntu0.18.04.3+esm3 | [open-vm-tools-desktop 2:11.0.5-4ubuntu0.18.04.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-open-vm-tools-desktop-2-11.0.5-4ubuntu0.18.04.3-esm3.md) | Oct 25, 2023 |
| Linux | open-vm-tools-desktop Ubuntu 20.04 LTS (focal) | 2:11.3.0-2ubuntu0~ubuntu20.04.7 | [open-vm-tools-desktop 2:11.3.0-2ubuntu0~ubuntu20.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-open-vm-tools-desktop-2-11.3.0-2ubuntu0-ubuntu20.04.7.md) | Oct 25, 2023 |
| Linux | open-vm-tools-desktop Ubuntu 22.04.1 LTS (jammy) | 2:12.1.5-3~ubuntu0.22.04.4 | [open-vm-tools-desktop 2:12.1.5-3~ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-open-vm-tools-desktop-2-12.1.5-3-ubuntu0.22.04.4.md) | Oct 25, 2023 |
| Linux | open-vm-tools-desktop almalinux 8 | 12.2.5-3.el8_9.1.alma.1 | [ALSA-2023:7265](https://patchblox.com/security/data/fix/linux/alsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools-desktop almalinux 9 | 12.2.5-3.el9_3.2.alma.1 | [ALSA-2023:7277](https://patchblox.com/security/data/fix/linux/alsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-desktop amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-desktop ol 8 | 0:12.2.5-3.0.1.el8_9.1 | [ELSA-2023-7265](https://patchblox.com/security/data/fix/linux/elsa-2023-7265.md) | Nov 21, 2023 |
| Linux | open-vm-tools-desktop ol 9 | 0:12.2.5-3.0.1.el9_3.2 | [ELSA-2023-7277](https://patchblox.com/security/data/fix/linux/elsa-2023-7277.md) | Nov 16, 2023 |
| Linux | open-vm-tools-desktop-debuginfo amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-devel amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-salt-minion RHEL 8 | 0:12.2.5-3.el8_9.1 | [RHSA-2023:7265](https://patchblox.com/security/data/fix/linux/rhsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools-salt-minion RHEL 9 | 0:12.2.5-3.el9_3.2 | [RHSA-2023:7277](https://patchblox.com/security/data/fix/linux/rhsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-salt-minion Ubuntu 22.04.1 LTS (jammy) | 2:12.1.5-3~ubuntu0.22.04.4 | [open-vm-tools-salt-minion 2:12.1.5-3~ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-open-vm-tools-salt-minion-2-12.1.5-3-ubuntu0.22.04.4.md) | Oct 25, 2023 |
| Linux | open-vm-tools-salt-minion almalinux 8 | 12.2.5-3.el8_9.1.alma.1 | [ALSA-2023:7265](https://patchblox.com/security/data/fix/linux/alsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools-salt-minion almalinux 9 | 12.2.5-3.el9_3.2.alma.1 | [ALSA-2023:7277](https://patchblox.com/security/data/fix/linux/alsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-salt-minion amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-salt-minion ol 8 | 0:12.2.5-3.0.1.el8_9.1 | [ELSA-2023-7265](https://patchblox.com/security/data/fix/linux/elsa-2023-7265.md) | Nov 21, 2023 |
| Linux | open-vm-tools-salt-minion ol 9 | 0:12.2.5-3.0.1.el9_3.2 | [ELSA-2023-7277](https://patchblox.com/security/data/fix/linux/elsa-2023-7277.md) | Nov 16, 2023 |
| Linux | open-vm-tools-sdmp RHEL 8 | 0:12.2.5-3.el8_9.1 | [RHSA-2023:7265](https://patchblox.com/security/data/fix/linux/rhsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools-sdmp RHEL 9 | 0:12.2.5-3.el9_3.2 | [RHSA-2023:7277](https://patchblox.com/security/data/fix/linux/rhsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-sdmp Ubuntu 20.04 LTS (focal) | 2:11.3.0-2ubuntu0~ubuntu20.04.7 | [open-vm-tools-sdmp 2:11.3.0-2ubuntu0~ubuntu20.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-open-vm-tools-sdmp-2-11.3.0-2ubuntu0-ubuntu20.04.7.md) | Oct 25, 2023 |
| Linux | open-vm-tools-sdmp Ubuntu 22.04.1 LTS (jammy) | 2:12.1.5-3~ubuntu0.22.04.4 | [open-vm-tools-sdmp 2:12.1.5-3~ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-open-vm-tools-sdmp-2-12.1.5-3-ubuntu0.22.04.4.md) | Oct 25, 2023 |
| Linux | open-vm-tools-sdmp almalinux 8 | 12.2.5-3.el8_9.1.alma.1 | [ALSA-2023:7265](https://patchblox.com/security/data/fix/linux/alsa-2023-7265.md) | Nov 15, 2023 |
| Linux | open-vm-tools-sdmp almalinux 9 | 12.2.5-3.el9_3.2.alma.1 | [ALSA-2023:7277](https://patchblox.com/security/data/fix/linux/alsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-sdmp amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-sdmp ol 8 | 0:12.2.5-3.0.1.el8_9.1 | [ELSA-2023-7265](https://patchblox.com/security/data/fix/linux/elsa-2023-7265.md) | Nov 21, 2023 |
| Linux | open-vm-tools-sdmp ol 9 | 0:12.2.5-3.0.1.el9_3.2 | [ELSA-2023-7277](https://patchblox.com/security/data/fix/linux/elsa-2023-7277.md) | Nov 16, 2023 |
| Linux | open-vm-tools-sdmp-debuginfo amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-test RHEL 9 | 0:12.2.5-3.el9_3.2 | [RHSA-2023:7277](https://patchblox.com/security/data/fix/linux/rhsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-test almalinux 9 | 12.2.5-3.el9_3.2.alma.1 | [ALSA-2023:7277](https://patchblox.com/security/data/fix/linux/alsa-2023-7277.md) | Nov 15, 2023 |
| Linux | open-vm-tools-test amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |
| Linux | open-vm-tools-test ol 9 | 0:12.2.5-3.0.1.el9_3.2 | [ELSA-2023-7277](https://patchblox.com/security/data/fix/linux/elsa-2023-7277.md) | Nov 16, 2023 |
| Linux | open-vm-tools-test-debuginfo amzn 2023 | 12.3.0-1.amzn2023.0.1 | [ALAS2023-2023-423](https://patchblox.com/security/data/fix/linux/alas2023-2023-423.md) | Oct 30, 2023 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.