A customer has upgraded to 11.44.25 and has since got indications from AV scan that there are vulnerabilities in binaries in the Commvault installation directories. This is related to Python, OpenSSL, Apache Tomcat, Log4j and .NET 8.
When I compare with other systems running 11.44.25 I find that versions differs.
I can see newer versions included in the downloaded software, but they are not updated. For example .NET 8 which is soon end of live is still the active on the Commserve, even though .NET 10 is included in the download.
Can someone please describe at which point is these third party binaries updated and what could cause them not being updated?
/Patrik
