Operational Defect Database
BugZero found this defect 1540 days ago.
Data sources
All data on this page is proprietary to BugZero® or gathered from public sources
Veeam | kb3108
List of Security Fixes and Improvements in Veeam Agent for Microsoft Windows
Last update date:
3/13/2024
Affected products:
Veeam Agent for Microsoft Windows
Affected releases:
5.0
Fixed releases:
No fixed releases provided.
Description:
Purpose
This article describes all security-related fixes and improvements introduced in each release or update of Veeam Agent for Microsoft Windows. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam Agent for Microsoft Windows version to a later one.
Security Fixes and Improvements
6.1.0.349 OpenSSL library updated to 1.0.2zi. LZ4 library updated to 1.9.4. Stronger backup encryption. - (See pg. 7 of Veeam Backup & Replication 12.1 What's New PDF) 6.0.2.1090 OpenSSL Library updated to the newest version (1.0.2zg). 6.0.0.960 Added support for networks with NTLM authentication disabled (Kerberos-only authentication). Audit capabilities were improved. zlib has been updated to version 1.2.13. OpenSSL version has been updated to 1.0.2ze. 5.0.3.5029 OpenSSL was updated to v1.0.2zi. liblz4 was updated to v1.9.4. zlib was updated to v1.2.13. PuTTY was updated to 0.80. 5.0.3.4708 Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows was fixed. This vulnerability was reported by Nikita Petrov (Positive Technologies). 5.0.0.4301 LZ4 compression library version has been updated to version 1.9.2 4.0.2.2208 Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows was fixed. This vulnerability was reported by Nikita Petrov (Positive Technologies). 4.0.0.1811 A custom security descriptor was provided for the driver's control device (vulnerability reported by Mile Karry). Deserialization issues were fixed (vulnerability reported by Harrison Neal). A user authorization issue was fixed (vulnerability reported by Harrison Neal). OpenSSL was updated to version 1.0.2t
More Information
As we're establishing this new process, we appreciate any feedback on the content or format of this KB article. Please let us know in the related topic on the Veeam R&D Forums. If your feedback is too sensitive to be shared publicly, please submit it by opening a support case. We highly appreciate your collaboration!
