update .net framework on Veeam server

[bgkitware]

Hi, I am under the impression that .net framework 3.1.10 was installed with Veeam originally(4 years ago for us) or the Veeam v11 patch.

Is there any risk involved in updating this to 3.1.16? Is this safe or will this impact my Veeam server?

[Gostev]

Hello, Veeam Backup & Replication does not use .NET Framework 3.x and never did, so it was brought by some other software. As such, it does not matter for us what you do with it. Thanks!

[bgkitware]

Wow, when I go to uninstall it, it says that it's in use by Veeam AWS Service and Veam Azure Service. I would love to patch it.

[Mildur]

Ok, you don’t talk about .net Framework, you talk about .Net Core Runtime. There are different products and have different versions and requirements.

From the requirements guide:

https://helpcenter.veeam.com/docs/backu ... d-plug-ins

Microsoft .NET Core Runtime 3.1.10 or later

3.1.16 should be fine.

[dries.vergote]

Hi

Just to inform that there is a vulnerability in the .NET core runtime.
This is installed for the Veeam AWS, Azure & Google plug-ins.
reference: https://msrc.microsoft.com/update-guide ... 2021-43877

updates: https://dotnet.microsoft.com/en-us/download/dotnet/3.1

Please update your Veeam servers.

[pirx]

Yesterday we had our internal Windows patch day all unsupported/EOL versions of .Net core/runtime/framework were removed which immediately broke Veeam One Reporter and other Veeam components (VB4AWS plugin). This is a security disaster and immediately brought Veeam into focus of our internal security team.

Veeam support told me that Veeam still needs .Net runtime 3.1.x. This Version is EOL since December and we are only allowed to use .Net 6.x. This is something that was announced by MS long ago and most other applications took care of that long ago.

https://dotnet.microsoft.com/en-us/plat ... otnet-core
https://devblogs.microsoft.com/dotnet/n ... r-13-2022/


Is there any official statement when an update will be available that fixes this?

[Gostev]

Version 3.1.32 was literally just released by Microsoft in December 2022 so it's not some really old code that is a "security disaster" to use. It has no known vulnerabilities so I suggest you use this version until the above-mentioned products are updated.

All plug-ins included with VBR12 use .NET 6 and the upcoming release of AWS plug-in (which was supposed to come with VBR V12 but got delayed slightly) uses .NET 6 as well.

Regarding Veeam ONE, please check with its PMs in the corresponding forum on their plans.

P.S. As far as I know, .NET Core 3.1 to .NET 6 is not a simple in-place update as .NET 6 is a completely different product, as opposed to a later version of the same offering. So these cannot really be used interchangeably as in "we're allowed to use one but not another"... again, technically not the same product and just replacing one with the other may lead to unpredictable results.

[pirx]

3.1.x is EOL by MS since December it was released 2019 as LTS release with 3 years of support, it will not get any security updates. As MS states, any update to .NET 6 is a potential security issue in 3.1.x. .NET 6 was released in 2021, .NET 8 in 2023 (all LTS). 3.1.x EOL was announce long ago and there was plenty of time to plan. As other companies did. We really don't see many applications that do not support the LTS release 6.

Again, there is no way to continue to use EOL SW anymore here. Especially if this is not a simple in-place update, Veeam should have planned for it long time ago. I really don't think there is much to argue.