.Net Core 3.1 will reach EOL

[StephanG]

Hi everyone,

i recently saw that Net Core 3.1 will reach EOL
https://devblogs.microsoft.com/dotnet/n ... r-13-2022/

This was installed some time ago during an update. Now i need to update - but i could not find anything around.

BR
Stephan

[PetrM]

Hi Stephan,

May I ask you to clarify what exactly would you like to update and what you don't manage to find?

Thanks!

[brent-h]

Hello,
I wondered about this back in November (.NET core 3.1 becoming EOL in December and no longer receiving security updates) and opened a support case to ask (#05745395). I had initially noticed .NET core 3.1 getting installed in v11 or v11a which bundled the "cloud plugins" for AWS, Azure, and Google. When I downloaded and installed the latest version of these plugins, they had .NET 6 bundled instead. I mentioned this in the support ticket and here is an excerpt of their response:

As long as we are on a version higher than 3.1 we should be okay to remove the old .NET version. Please see the plug-in system requirments.

https://helpcenter.veeam.com/docs/backu ... rmservices

Based on that, I uninstalled .NET core 3.1 from my backup server (leaving .NET 6 installed and leaving .NET Framework as is, since that is separate from .NET core). I have run backups/replication/backup copy jobs (Hyper-V environment) since then and have not encountered any issues. The system requirements page (and another forum post: veeam-backup-replication-f2/net-core-3-1-t83706.html ) does show that the plugin for "Nunantix AHV" requires an older version, but I don't use that.

[PetrM]

Hi Brent,

I think that there was a misunderstanding with your support engineer. The last plug-in version 3.0 requires:
Microsoft .NET Core Runtime 3.1.10 or later with Veeam B&R 11.0.3.xxx
Microsoft .NET Core Runtime 2.1.23 or later with Veeam B&R 11.0.2.xxx

I'll speak to our support team so that they review the case once again and contact you for any additional clarifications. Also, I'll ask our tech writers to correct the system requirements accordingly.

Thanks!

[Kochkin]

I will highlight that the versions above are for AHV plug-ins only.

AWS/Azure have different .NET versions required (described in the system requirement)

[brent-h]

Hi again,
I think there may have been a misunderstanding about my post here: I do not use the AHV plug-ins and did not mention those in my support request since they were not relevant to my particular environment (Hyper-V). I only had AWS/Azure/Google since those get installed by default (which is what I asked about in the support request).

I was just mentioning AHV since according to the system requirements that also uses the old (now end-of-life) version (3.1 or 2.1) of .NET core (so it would not be safe to uninstall .NET core 3.1 yet if AHV is used).

[mberrey]

I have a customer in the same boat. Since .NET Core 3.1 is EOL they cannot use the plugins in their environment. What version will V12 be using with the included plugins?

[Kochkin]

All new plug-ins are using .NET 6

[pirx]

I wrote it already in a different thread. My company is now very rigid when it comes to EOL software. So everything .NET 3.1.x related was removed from every server - which not only broke Azure plugin. It also broke Veeam One Reporter. And release notes of Veeam One 12 still show 3.1.16 as required (https://www.veeam.com/veeam_one_12_release_notes_rn.pdf). For me this is a major issue and I really, really can't understand that Veeam did not solve this issue before the EOL of 3.1.x.

This was a LTS version that was released with 3 years support. EOL date 12/22 was known. New LTS version 6.x was released long ago. Now in 12/22 version 8.x.

[jorgedlcruz]

Hello,
As Roman has commented on the other thread, we are actively working to release a CU for Veeam ONE with .NET 6.x

I agree 100% with your statement, and we are working hard to avoid these kind of situations in the future.

We are working around the clock to have this. To be fully transparent, the code will be ready this week, and then we need some weeks to fully QA the product.

We are aiming middle of March, perhaps sooner, as soon as we have better insight, happy to share it here.

[pirx]

Is there any update on that? We are allowed to run with the last .NET 3.x version from December until end or March, that was already a thought discussion and there are not many applications within this company that got that exception. But security was very clear that there will be no further extension and what is worst, they now have Veeam on their radar.

[Mildur]

Hi Pirx

Patch for Veeam One was released yesterday:
https://www.veeam.com/kb4430

What's New
Microsoft .NET libraries have been upgraded to version 6.0.14.

Best,
Fabian

[pirx]

But only for Veeam One 12, nothing for 11, or am I wrong?

[jorgedlcruz]

Hello, that is correct. The work upgrading the libraries is only for v12 last patch onwards.

Thank you

[pirx]

That's hilarious. Veeam 11 is EOS 02-2024 and yet Veeam tries to force the customers to updatet to v12 now. I guess we'll now have to talk to Veeam sales rep urgently.

Can you please describe what EOS means for Veeam? I doubt that we have a common understanding here.

Edit: I see that Veeam has an end of maintenance and end of support date. Still, expecting customers immediately to update to an bleeding edge version to fix security issues is not acceptable to me. We currently have a hard time to argue that we use 2 backup products. And sadly those things (updates, LTS version, security etc) are handled much more professional and predictable with our second vendor.

[jorgedlcruz]

Can you please describe what security issues have been announced in .Net 3.1? Because as far as I know Microsoft announced an update for it not long ago that fixes some issues. And you can update to that last 3.1.x manually in VONE v11/v10.

[pirx]

The last update was in December 2022 (EOS: December 13, 2022, fixed CVE-2022-41089 Remote Code Execution Vulnerability), this was the last update that 3.1 has received. MS is very clear that any update to newer versions of .NET are a potential security issue in 3.1. That .NET 3.1 will be EOS 12-2022 was known for years. And it was EOS even before Veeam One v12 was released. It was on MS roadmap from the beginning. I think that is a huge problem nowadays, projects use libraries in their products but don't really care about their lifecycle or worst their security issues (log4j....).

German BSI (German Cyber department) is also very clear about the usage of EOS software. And our internal security is very strict. On >2000 Windows server all .NET 3.1.x instances have been removed.


https://github.com/dotnet/core/blob/mai ... /3.1.32.md

End of life (EOL)

End of life refers to the date when Microsoft no longer provides fixes, updates, or online technical assistance. End of life may also be referred to as 'end of support' (EOS).

As the end of life nears for a given .NET version, we recommend that you move to a newer .NET version, and reduce/remove your use of the given .NET version. After support ends, we recommend that you uninstall a given .NET version if you are no longer using it, or install the latest patch, and accelerate your plans to remove your use of that .NET version./

Your use of out-of-support .NET versions may put your applications, application data, and computing environment at risk. You are strongly recommended to not use out-of-support software.

[jorgedlcruz]

I understand, for that reason we put the effort to bring into Veeam ONE v12 P20230314 so Companies following German BSI, or other EU/US regulations have a chance to upgrade to this version and have a supported, LTS, .NET version.

As far as I know, it happens the same for VBR AWS/Azure Plugins, updated only on the latest releases.

You have a fix for both VBPlugins and Veeam ONE using the most recent version of the software. At the moment we are not planning to move to .Net 6.x in VONE v11, and as Gostev said in another thread the last update for 3.1.32 was released in December, so it is not like a 6 years old software without updates.

One thing I do not understand is, will your current BSI be okay with VONE/VBR v11 being on End of Fix? Knowing that End of fix means:

When a product version reaches this stage, no further Updates, Patches or Hotfixes will be created for it (exceptions may be made on a case-by-case basis). A version that has reached End of Fix, but that has not reached End of Support is still fully supported. However, if Veeam determines that an issue you are facing is fixed in a generally available version, you will be required to update to it.

We have this table, and policy for quite some years. Here is an snapshot from October 2022

I think that is predictable enough to make the required plans. And as you can see on what End of Fix says "if Veeam determines that an issue you are facing is fixed in a generally available version, you will be required to update to it." There is no surprises here.

[pirx]

Good that you bring up the last point. This is what I meant earlier, forcing users to immediately update to a bleeding edge new version just to get security fixes (not no features) is not what we expect. Especially with no overlap, I've not seen many Enterprise SW's that do it like Veeam. It's like: hey there is a security issue, we released v12 yesterday, so hurry up an update to a new major version. To be clear, we were beaten by every single update of Veeam in the past. We do not update on day 1 and we usually wait at least until U1 is available (which was also the recommendation by Veeam support in the past and Veeam consultants that planned and supported our updates).

And maybe we did not take this into account when we decided to use Veeam and have now to reevaluate.

Example for our other backup sw. You can see that there are always time where a new and old versions are supported. Even without LTS release. And new releases are rolled out more frequently. I've always voted for Veeam, but lately it's getting really hard to do this. Release cycle feels very 'old fashioned' and not having adopted to Enterprises needs (no fixes after new version is GA) is not helping here.

Code: Select all

Release Name                        Technology Preview date       General Availability date      End of life date
Platform Release 2023 (11.30)       December 15, 2022             February 15, 2023             December 15, 2023
Platform Release 2022E
(11.28) (Long-Term Support)         June 15, 2022                 August 15, 2022               June 15, 2025
Feature Release 11.26               December 15, 2021             February 15, 2022             December 15, 2022
Feature Release 11.25               September 15, 2021            November 15, 2021             September 15, 2022

so it is not like a 6 years old software without updates

Well, it's a 4 years old sw that was known to get no updates after 12-2022. And it does not get any updates, that what's EOS means here. There is really no excuse for this in terms of security or planning to update Veeam components before it went EOS. That is simply the price for using any 3rd party library or sw.

[pirx]

And planning in advance with a 'End of Fix' = 'Next GA date' is also not very helpful either, as the GA date is not announced much before it's GA (it's ready when it's ready). I really hope Veeam rethinks its policies and product strategy here. Not all companies want or can update to latest greatest version ASAP and this should/must be takten into account be Veeam.

[jorgedlcruz]

Thank you for the detailed explanation, however this sentence is wrong " You can see that there are always time where a new and old versions are supported" Because v11 it is sill supported of course, and security patches, or really any other patch/hotfix could be created as it happened with last vulnerability.

Regarding the "new releases are rolled out more frequently":
I can see that the vendor you mentioned releases "feature releases" every year. Which can compare to Veeam more or less:

• v10 - 2020-02-18
• v10a - 2020-07-30
• v11 - 2021-02-24
• v11a - 2021-10-07
• v12 RTM - 2023-01-30

In terms of patches, I prefer not to list them all, full list is here, but they are really frequent as Enterprises require, and they do not only include security fixes, but bug fixes, and sometimes some minor new features or improvements.

This "(no fixes after new version is GA)" it is not true as well, as per the software policy you agreed when purchased the product. And as we state "When a product version reaches this stage, no further Updates, Patches or Hotfixes will be created for it (exceptions may be made on a case-by-case basis)." Like for example v11.0.1.1261 P20230227.

The update to VONE v12 with latest patch takes less time than what it took me to write this very last message, and it will give you .NET 6 LTS. At the moment, it will not be an exception to update Veeam ONE v11 to .NET6 , having VONE v12 P20230314 GA that fixes it.

Your feedback is noted for sure, thank you for all the comments.

[pirx]

I can see that the vendor you mentioned releases "feature releases" every year. Which can compare to Veeam more or less:

So there were 5 Veeam versions (not patches) between 02-2020 and 02-2023, where the other vendor had 10 feature releases (11.19 - 11.30) if I did not missed anything. And LTS releases that are supported for 3 years. But it's not about those numbers, it was just an example. And as always, if we are not happy we have to use a different product. I can't force Veeam into doing anything, not more frequent updates or longer _guaranteed_ security fixes for old versions. And guaranteed is the important part her.

The update to VONE v12 with latest patch takes less time than what it took me to write this very last message, and it will give you .NET 6 LTS. At the moment, it will not be an exception to update Veeam ONE v11 to .NET6 , having VONE v12 P20230314 GA that fixes it.

Yeah, next - next - finish is only rarely a problem. As well as the time needed for the update itself. Fixing everything that is broken afterwards and missing SLAs and backups are the issues. You might get in contact with Brad B. from (Senior Customer Success Engineer) and talk with him about our update to v11 and the aftermath. This also should just have fixed our v10 issues and 5-6 private fixes we had there.

Updating to latest version is not always an option and being forced to so to fix (potential) security issues doesn't make people happy.

[doktornotor]

What is the huge .Net 3.1.x vulnerability that all this fuss is about? SCNR.

[Mgamerz]

I haven't updated to V12 given the large list of issues I've seen on this forum and on the veeam subreddit. But my organization no longer allows .NET 3.1 because it is EOL and we don't have EOL software on our systems. So I'm essentially having to choose between potential security risks that grow greater as it takes longer to stabilize (as well as deal with higher ups demanding its removal), or risk having a potentially broken backup system.

I have to say I'm pretty disappointed in how V12 has been rolled out. It's not the bugs (all software has bugs), but releasing after EOL of things the previous version depends on doesn't really seem like you were thinking about the customer when to get security updates you force them to upgrade to a buggy version of software.

[jorgedlcruz]

Hello Mgamerz,
We have not seen, and are not seeing currently many issues with Veeam ONE v12. A few of them, like the database growth with Agents, we addressed with a Hotfix to Customers who opened a case, and yesterday we published the patch with that and other issues.

"or risk having a potentially broken backup system." Veeam ONE is part of the Veeam Data Platform, but even if you upgrade, we will not interfere with Veeam Backup and Replication so we will never break the "backup system", as much you might have some slowness some reports, or dbs growing problems like the ones reported and fixed.

The feedback is noted regarding the .NET 3.1x EOL for VONE v11a.

[Mgamerz]

Right, sorry - thought I was on the VBR forum, not sure how I got into Veeam One's. Still going to wait though until someone gets too upset higher up

[Gostev]

@Mgamerz VBR does not use .NET Core 3.1 in V11 or V12, the whole issue is with Veeam ONE only.

[Mgamerz]

Well, I think the lesson here is that I need to learn how to read what forum I am on and do a bit more research before posting

[Gostev]

You read it right, I too remember this thread being in the VBR forum originally but now it's where it should be.

[karsten123]

.NET Core will be installed with vbr. Which components do need it? Is it safe to uninstall?