Hello CarlAAM,

Here is a link to a KB about this issue.

https://dell.to/3VMGQAJ

so what are possible workarounds?

1) firewall vcenter -- I am guessing that's a valid option, do I only need to block 80/443? Do I firewall at the vcenter level/the network level? What does still need access to it? The witness nodes, the esxi servers?

2) can I just temporary poweroff the vcenter until there is a fix available via VxRail? What are the consequences of that besides me not being able to manage the VMs

3) can I just install the patch by VMware directly? Is that possible -- how do I get back to a "normal" VxRail with embedded vCenter afterwards? :)

Hello Klaas,

As stated in the KB There is no workaround for this issue currently.

@DELL-Sam L​ well of cause there are workarounds, the easiest one, but one I would not like to do is: just shutdown vxrail until an update is available :)

The other 3 ideas I suggested in my previous post seemed like a better idea though.

Hello Klaas,

There are not any official work arounds yet that DellEMC has published for this issue. We are actively working this issue and when there are workarounds or patches they will be published on this link. https://dell.to/4bdkCwv

Dell has missed their promised 14 day window for updates: https://www.dell.com/support/kbdoc/en-us/000182153

@DELL-Sam L​  

Hello, 

when can we expect an update from Dell for the security vulnerability? The vulnerability has been open for more than 14 days now, with no prospect of an update.

Dell has released the update for version 7:

https://www.dell.com/support/home/en-us/product-support/product/vxrail-software/drivers

https://www.dell.com/support/manuals/en-us/vxrail-software/vxr_p_vxrail_release_notes_v7.0/what-is-new-in-vxrail-7.0.521?guid=guid-ff374bc7-c9ae-4f83-b157-1fa54c3d18ae&lang=en-us

but the has failed to announce it on their security site:

https://www.dell.com/support/security/en-us ...

https://www.dell.com/support/kbdoc/en-us/000226863/dsa-2024-289-security-update-for-dell-vxrail-8-0-213-multiple-third-party-component-vulnerabilities was released yesterday evening ~4 weeks after the VMware update