.NET updates on Veeam Server

[Zew]

The vuln audit shows .NET needs updating on our Veeam server.
I updated to the latest 12.1 build. Removed some older builds of ASP.NET core that were no longer needed.
I see it still shows as needing .NET updates.
Veeam server has ASP.NET 6.0.25, latest builds of .net (https://dotnet.microsoft.com/en-us/download/dotnet/6.0) shows 6.0.27
This community posthttps://community.veeam.com/cyber-secur ... ities-6297 shows the same concept when 6.0.24 needed updating to 6.0.25
This KB (which is old)https://www.veeam.com/kb4410 seems to show the same type of steps.

What's the best way to get my server compliant without breaking functionality.

[Mildur]

Hi Zew

If you are running v12.1 then you can just update to the latest version of .NET 6.0 and reboot your server. All of our integration plugins on Veeam Backup & Replication v12.1 do support .NET 6.0 and later.

We will also update our installation ISO if there are new security related .NET 6.0 updates.
Keeping .NET maintained on existing backup server is done through windows updates or manual updates through the server administrator.

Thanks,
Fabian

[Zew]

Thanks,

I manually downloaded and installed both:
ASP.NET Core 6.0.27
.NET Desktop Runtime 6.0.27

Both installs required no reboot. Everything still works, thanks.

[Mildur]

Thank you for your feedback.
We plan to include the new .Net version in the next ISO (with patch 12.1.2) This will make sure that new deployments will have .NET 6.0.27 from the beginning.

Best,
Fabian

[DLN]

Hi Fabian
I'm sorry to hijack this post.
Any eta on how the next patch will be released?

[Mildur]

No ETA yet.
If the question is for the .NET update, then you can manually update .NET on existing servers. Installing a Veeam patch won‘t update .NET.

For all other product related questions please use a new topic (or support for technical issues)

Best,
Fabian

[pirx]

.NET 6 is EOS November 12, 2024. Our Windows team will remove all .NET 6 components by then. As far as I can see Veeam B&R 12.1 still only supports .NET 6.

What are the plans of Veeam to support .NET 8 by the EOS time of .NET 6?

[Mildur]

Hi Pirx

.NET 6 was required by our platform plug-ins (AWS, Azure, GCP, Nutanix, ...)
The latest AWS and Azure plugins already use .NET 8. Other plugins should follow by the end of year.

I suggest to come back later this year to check the status.
Or check the user guides which will list .NET requirements (I saw that it wasn't updated to the latest .NET requirements for our plugins. I will ask our team to update it).
https://helpcenter.veeam.com/docs/backu ... m-plug-ins

Best,
Fabian

[pirx]

Veeam One is the one other thing that is still using .Net 6. But that's different forum section, I'll raise my question there.

Veeam ONE supports only .NET version 6.0. Using any .NET version other than 6.0 can result in errors or failure in Veeam ONE.

[Mildur]

Yes, that makes sense. That way the Veeam One team will see your comment and can answer directly for their product.

Best,
Fabian

[pirx]

Are the plugin versions mentioned on that page up to date? AWS plugin is now 12.8.0.xxx.

https://helpcenter.veeam.com/docs/backu ... m-plug-ins

[Mildur]

No, but I already have asked our user guide team to update the VBR user guide.

Best,
Fabian

[Mildur]

Hi Pirx

The helpcenter has been updated:
https://helpcenter.veeam.com/docs/backu ... m-plug-ins

Best,
Fabian

[brent-h]

Hi,

According to the requirements (linked above), the backup server/console also requires "Microsoft Windows Desktop Runtime 6.0.29" (it was updated through Windows update to 6.0.33 in August when the .NET 6.0.33 update (KB5042131) was installed). This is also part of .NET 6 (see https://dotnet.microsoft.com/en-us/download/dotnet/6.0 ), which would also be EOS/EOL in November 2024. What components use that/can it be uninstalled?

[Mildur]

Hi brent

Our integration plugins do use .Net: https://helpcenter.veeam.com/docs/backu ... m-plug-ins

We will have a .NET 8-supported release with new plugin versions (v12.2) available before November. I recommend waiting until v12.2 is released.

Best,
Fabian

[Parnassus]

Hi Fabian, hi all!

Once upgrading the Veeam ONE 12.1 and Veeam B&R Server 12.1 to newly released version 12.2 (12.2.0.334), the Microsoft ASP .NET Core 8.0.7 Shared Framework software component was installed side by side with the previously present Microsoft ASP .NET 6.0.x (.NET 6.0 is used by 12.1.2.172 and previous builds).

Questions:

(1) Could now both Microsoft .NET Runtime 6.0.x and Microsoft ASP .NET Core 6.0.x be safely uninstalled (provided that a Veeam Pluging still specifically requiring the ASP/.NET 6.0.x are not actively used)?
(2) Is also still safe to update to latest available Microsoft ASP .NET Core 8.0.8 (Shared Framework), released by Microsoft on August, 15th 2024?

With regard to question (2), what packages exactly should be used (and what should not) to update the installed Microsoft ASP .NET Core 8.0.7 Shared Framework?

- Microsoft ASP.NET Core Runtime 8.0.8
- Microsoft .NET Runtime 8.0.8
- Microsoft .NET Desktop Runtime 8.0.8

I ask the above because (a) the 8.0.8 fixes two vulnerabilities (CVE-2024-38168 ".NET Denial of Service Vulnerability" and CVE-2024-38167 ".NET Information Disclosure Vulnerability") and because (b) I currently have (manually updated):

- Microsoft ASP.NET Core Runtime 6.0.33
- Microsoft .NET Runtime 6.0.33
- Microsoft .NET Desktop Runtime 6.0.33

and I don't remember if the Microsoft .NET Runtime was really required (Microsoft ASP.NET Core Runtime 8.0.7 and Microsoft .NET Desktop Runtime 8.0.7 were installed with the Veeam 12.2 upgrade).

Thank you.

[Mildur]

Hi Davide

There is one last plugin which still requires .NET 6:
https://helpcenter.veeam.com/docs/backu ... m-plug-ins
I recommend to wait a little longer before removing the old .NET 6 installation.

You can patch .NET within the same major release. So it's ok to do the update to v8.0.8.

Best,
Fabian

[Parnassus]

Hi Fabian, do you mean the "Google Cloud Plug-in for Veeam Backup & Replication version 12.0.3.xxx and later", if so I was referring exactly to it.

So, in the end, we can safely update to:

- Microsoft ASP.NET Core Runtime 8.0.8
- Microsoft .NET Desktop Runtime 8.0.8

keeping the old .NET 6.0.x at least until the above Plug-in will be updated to support .NET 8.0 even if we don't use features provided by that Plug-in (indeed I don't want to create issues by removing .NET 6.0 especially if it is still necessary with Veeam 12.2.0.334).

Thanks.

[Parnassus]

Hi Fabian, does the restriction/recommendation about keeping the Microsoft .NET 6.0 on 12.2 apply also to Veeam ONE 12.2?

Just a note, reading the Veeam B&R 12 page you linked it's highlighted this: "The Microsoft .NET Core Runtime and Microsoft ASP.NET Core Shared Framework must be of the same version (up to the minor version number). Otherwise, starting the plug-in will fail.", does this mean that IF we don't start (use) the Plug-In still requiring the .NET 6.0 cited above then removing the .NET 6.0 will not cause any issue during the operation of Veeam B&R 12.2 if that feature is not used (and it does only if we start using the Plug-In)? just to clarify.

[Mildur]

Hi Davide

For Veeam One please ask in the VeeamOne forum: post523872.html#p523872
The Veeam One PMs can better answer this question. But I assume VeeamOne has successfully migrated all their components to .NET 8 in the latest release v12.2.

Otherwise, starting the plug-in will fail

If I remember correctly, the configuration backup job will bring up warnings if the plugin doesn't run. I would leave .NET 6 installed on the VBR server for now until we can confirm that it is not required anymore.

So, in the end, we can safely update to:

- Microsoft ASP.NET Core Runtime 8.0.8
- Microsoft .NET Desktop Runtime 8.0.8

Correct.

keeping the old .NET 6.0.x at least until the above Plug-in will be updated to support .NET 8.0 even if we don't use features provided by that Plug-in (indeed I don't want to create issues by removing .NET 6.0 especially if it is still necessary with Veeam 12.2.0.334).

Correct. .NET 6 is still supported by Microsoft. Let's wait for official news from Veeam regarding the Google plugin.

Best,
Fabian

[RomanK]

Hello Davide,

For Veeam ONE it is correct, you may uninstall redundant libraries, just make sure you are following the system requirements / alternative link.

It's also worth checking if some other software installed on the machine with Veeam ONE doesn't use it.

Thanks

[Parnassus]

Hi! Thanks! yes, I've just read now this statement about the Veeam ONE 12.2: "Veeam ONE supports only .NET version 8.0. Using any .NET version other than 8.0 can result in errors or failure in Veeam ONE." so I'm going to uninstall Microsoft .NET 6.0 (I've no other restrictions).

[ratkinsonuk]

Hi R&D.

I'm getting grief from our SecOps team as they've spotted Veeam is using an out-of-support version of the DotNet library. I removed v6.0.36 from my Dev server, then upgraded B&R from v12.1 to v12.2 and it's installed NetCore 6.0.32 and 8.0.7. The v6 stream is now end-of-life and unsupported.

Is this something you're aware of and actively removing? I know some of the DotNet bundle was only required for the AWS/Azure services, so I assume I can remove it from my Dev server for now.

Cheers, Rob.

[Mildur]

Hi Robert

Please see this topic. Almost all plugins are running on .NET 8 now. Only our Google Cloud Plug-in is not updated yet.
Our upcoming release v12.3 (soon to be released) should remove all dependencies on .NET 6.

Best,
Fabian

[ratkinsonuk]

Thanks Fabian. Removing the v6 stream is quite a pain as none of the usual MS tools can be used. I'd appreciate it if you can add the DotNet v6.x uninstall to whatever v12 release removes the dependency so we don't have to manually hack around on the server.

Cheers, Rob.

[Mildur]

Hi Rob,

Thank you for your feedback.
The removal of third-party components should normally be handled by the server administrator, as Veeam products cannot determine whether other tools on your backup machine still need .NET 6.
It's also too late in the release cycle to add such a feature since the release of v12.3 is expected within days, not weeks. But we can think about it for future versions of the product.

Best regards,
Fabian

[ratkinsonuk]

Understood Fabian. If it's of any use to others, the best way I've found to remove the v6 Windows versions is to run the original installer, e.g. 'windowsdesktop-runtime-6.0.32-win-x64.exe' and select the uninstall option.

The installers can all be found at https://versionsof.net/core/6.0/

Cheers, Rob.

[Mildur]

Thanks for sharing

Best,
Fabian

[Mildur]

Hi Robert

V12.3 with the new GCP plugin is available in our download center.
Help center, KB articles, "Whats New"- and release documents are updated in the next few hours.

Best,
Fabian

[Parnassus]

Hi all, just a late update: since Veeam B&R Server 12.3.0.310 we were able to completely remove Microsoft .NET 6 components and just keep the Microsoft .NET 8 components updated (as of today, Microsoft ASP.NET Core Runtime 8.0.13 and Microsoft .NET Desktop Runtime 8.0.13). All of this without noticing any particular issue so far.