After installing vCenter/ESXi 7.0 U3s patch, unable to reinstall Nimble plugin

[Rory Schmitz]

To remediate the CVE's below, we've upgraded to the latest VMware 7.0 U3s, but now our vcenter client plugins give us the following error..  Please advise.

Error deploying plug-in. java.lang.IllegalStateException: Cannot convert value of type 'java.lang.String' to required type 'com.fasterxml.jackson.databind.PropertyNamingStrategy' for property 'propertyNamingStrategy': no matching editors or conversion strategy found org.springframework.beans.TypeConverterDelegate.convertIfNecessary(TypeConverterDelegate.java:262)

• CVE-2025-22224 (CVSS score: 9.3) - A Time-of-Check Time-of-Use (TOCTOU) vulnerability that leads to an out-of-bounds write, which a malicious actor with local administrative privileges on a virtual machine could exploit to execute code as the virtual machine's VMX process running on the host
• CVE-2025-22225 (CVSS score: 8.2) - An arbitrary write vulnerability that a malicious actor with privileges within the VMX process could exploit to result in a sandbox escape
• CVE-2025-22226 (CVSS score: 7.1) - An information disclosure vulnerability due to an out-of-bounds read in HGFS that a malicious actor with administrative privileges to a virtual machine could exploit to leak memory from the vmx process

[PatrickLong]

Maybe the same (or similar to) the issue encountered in previous upgrades with a workaround that involves Nimble support restarting jetty service on your array(s) as described in this post. and addressed in Customer Advisory a00142228en_us  What version of NimbleOS is on the array(s) linked to your vCenter, and what version is your VCSA?  The latest VCSA is vCenter Server 7.0 Update 3t version 7.0.3.02200 released 2024-10-21..  I assume you updated the host ESXi version to ESXi 7.0 Update 3s build 24585291 released today...

[Rory Schmitz]

Thanks for that info.  The customer advisory link didn't appear to work for me.  I'll try searching the number, though.

Below are the versions we're running:

Nimble: 6.1.2.500-1053701-opt
ESXi Hosts: VMware ESXi, 7.0.3, 24585291
VCSA: 7.0.3.02200 build 24322018

[PatrickLong · Accepted solution]

The advisory  https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00142228en_us  

states that affected versions are: 

• OS versions 6.1.2.501 and earlier 
• vCenter 7.0u3q (Build: 23788036) and later

So I'm sure this can be fixed in your case by upgrading NimbleOS to 6.1.2.502 or latest  version 6.1.2.600.  If your environment requires a maintenance window to do that, then a short-term solution would be to call Nimble Supoort and ask them to apply the workaround (which is to restart the jetty service on your arrays(s) which makes the array GUI unavailable for a minute or two while restarting, but does not interrupt the array serving I/O) and then have you retry reinstalling the plugin.

[Rory Schmitz]

That link works great.  I apprecaite the VERY quick responses.  We'll work on getting our Nimble version updated, but I'm showing a DECLINED_SUPPORT_GM for that version. I'll reach out to support and see which direction they'd like to take, the workaround or approve that update for us.

[buzzsubash]

DECLINED_SUPPORT_GM is due to array being out of active support. Can you please confirm if the customer has renewed support contract recently ?

[Rory Schmitz]

We did reach out to support and they let us know that one of the two arrays in the group were out of support.  We've since sent in the renewal approval and awaiting it to be appled.  We'll then get the arrays updated.  Thanks for the help, everyone!