Horizon Connection Servers Log4j

[IPPDJ]

Hello,

It looks like most of the vulnerabilities with Horizon connection servers is related to HTML access.

Can we just disable HTML pool access in Horizon or is upgrading the connection servers absolutely needed?

Does the upgrade completely remove HTML as an option?

[Jubish-Jose]

Please see the KB https://kb.vmware.com/s/article/87073

According to this, we can remove HTML access component by reinstalling the Connection Servers, which should be good enough. 

[IPPDJ]

I did see this, this is a specific question that a solutions architect had instead of going through that process.

Uncertain if just disabling HTML access on the pool level would suffice or if reinstalling to make sure all the HTML stuff isn't even there is what is needed.

[sjesse]

disabling html pool access, doesn't remove the html component like reinstalling does.

[IPPDJ]

This is exactly where my head was at with this, I just wanted confirmation from the VMware side to show the SA.

[sjesse]

To be clear I don't work for VMware, to get a verified answer open an SR