Description

Microsoft is releasing this security advisory to provide information about a vulnerability in OMI.
Fixes have been released for three Elevation of Privilege (EoP) vulnerabilities and one unauthenticated Remote Code Execution (RCE) vulnerability in the Open Management Infrastructure (OMI) framework: CVE-2021-38645, CVE-2021-38649, CVE-2021-38648, and CVE-2021-38647.
All customers using OMI with a version below 1.6.8-1 are impacted.

Patches

The issues have been patched in OMI version 1.6.8-1. All versions >1.6.8-1 are safe from these vulnerabilities.

Workarounds

None

References

• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647
• Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information.

If you have any questions or comments about this advisory, refer to the link here