The 'package.access' entry in the 'catalina.properties' file implements access control at the package level. When properly configured, a Security Exception will be reported if an errant or malicious web app attempts to access the listed internal classes directly or if a new class is defined under the protected packages. The vSphere UI comes preconfigured with the appropriate packages defined in 'package.access', and this configuration must be maintained.
Navigate to and open /usr/lib/vmware-sso/vmware-sts/conf/catalina.properties. Ensure that the 'package.access' line is configured as follows: package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.jasper.,org.apache.tomcat.