Where is a patch for 12.2

[Spex]

It happened again.

Shortly after Veeam informed the world about new security issues with VBR, the only way we could fix it was to perform a full installation of the next maintenance release. Last time 12.1 -> 12.2, this was also the only way to proceed and we were told that there were so many groundbreaking changes that no patch could be offered.
And this time? 12.3 - with so many changes and new features, it would have even deserved a version 13.0 and again not a simple patch.

Just before Christmas, I now have to update many servers with a major new version.
And the first steps with this version are not promising:
- VC++ components fail during setup and need to be installed manually
- Setup fails the first time with PostgreSQL issue (we use MS SQL)
- PostgreSQL is installed – we don't need it
- Linux repo server has: "Installing Installer Service Error: Unable to invoke /opt/veeam/deployment/veeamdeploymentsvc command because it was not found"

This is not in the customer's interest!

[Gostev]

Actually you don't have to update to 12.3 to address these vulnerabilities, you can instead just apply simple mitigations documented in the KB article.

[Spex]

Thx for pointing me to the mitigations - I wasn't aware of them.

But looking now closer these mitigations are not strong (trust vbr users with a role to not use the expoit) or not very easy to use in practise: the agent problem can be mitigated by analyzing whether all agent backuped servers have path settings with untrusted paths. These ar servers of my customers...

So the question remains for me why are there no patches.

[Gostev]

Because these are not Critical severity issues which have very low potential of exploitability (they require an authenticated OS user with a backup server role assigned) and have simple mitigations available which completely address the vulnerabilities, even if you for some reason call them "not strong" (note there are no such term in security when it comes to vulnerability mitigation: it either mitigates vulnerability, or it does not).