Note: These fixes and updates are available starting with Backup and DR release 11.0.17.496.

Note: These fixes and updates are available starting with Backup and DR release 11.0.17.496. These fixes are not rolled out to the 11.0.16 release; we recommend upgrading the backup/recovery appliance to version 11.0.17 to receive these updates.

Security Bulletin – Appliance:

• Addressed multiple input sanitization vulnerabilities, including SQL injection and cross-site scripting (XSS), across appliance platform server utilities.
• Remediated an authorization and validation vulnerability in user management workflows.

Security Bulletin – Host Agent:

• Strengthened local RPC interface access controls and improved credential isolation between concurrent backup jobs on the Host Agent.
• Hardened database layer against command injection, path traversal, and unauthorized directory permission modifications.
• Remediated local privilege escalation vulnerabilities in Oracle and SAP HANA host agent environment and profile handling.
• Improved temporary file creation and link handling across Windows and Linux Host Agents to mitigate symlink race conditions.
• Addressed buffer overflow vulnerabilities in Linux Host Agent components.

Libraries Bugs (Appliance):

• Upgraded third-party runtime and application libraries (including Go and Java packages such as Netty and Jackson Databind) on the appliance management server.
• Updated the Linux kernel and base operating system packages across Backup and DR appliance virtual machine images to mitigate reported vulnerabilities.