Skip to main content
commvault.com commvault.com
Question

At witch point is third party binaries updated on a Commserve

  • Oct 28, 2026 7:07 AM UTC
  • 2 replies
  • 27 views
Certified Expert
Forum|alt.badge.img+9

A customer has upgraded to 11.44.25 and has since got indications from AV scan that there are vulnerabilities in binaries in the Commvault installation directories. This is related to Python, OpenSSL, Apache Tomcat, Log4j and .NET 8. 

When I compare with other systems running 11.44.25 I find that versions differs. 

I can see newer versions included in the downloaded software, but they are not updated. For example .NET 8 which is soon end of live is still the active on the Commserve, even though .NET 10 is included in the download. 

Can someone please describe at which point is these third party binaries updated and what could cause them not being updated?

/Patrik

2 replies

Vaulter
Forum|alt.badge.img+17
  • PradeepVaulter
  • Vaulter
  • Oct 29, 2026 1:19 AM UTC

HI ​@Patrik ,

The required .NET version updates are handled during the Maintenance Release installation. Hence, we recommend downloading the recently released MR and running the installer, which should automatically patch the required .NET version.

Certified Expert
Forum|alt.badge.img+9
  • PatrikCertified Expert
  • Author
  • Certified Expert
  • Oct 29, 2026 7:05 AM UTC

HI ​@Patrik ,

The required .NET version updates are handled during the Maintenance Release installation. Hence, we recommend downloading the recently released MR and running the installer, which should automatically patch the required .NET version.

Thanks Pradeep, 

So upgrade of thirdparty binaries should happen with MR releases? 

This is a summary of what MS defender found on the Commserve after upgrade to latest MR 44.25:

 

Python / CVPython - Update Python, 27 vulnerabilities

C:\Program Files\Commvault\ContentStore\CVPython\python.exe

 

OpenSSL - Update OpenSSL, 35 vulnerabilities

...\Commvault\ContentStore\CVPython\libcrypto-3.dll, libssl-3.dll

...\Commvault\ContentStore\Base\libcrypto-3*.dll, libssl-3*.dll

 

Apache Tomcat - Update Tomcat, 12 vulnerabilities

...\Commvault\ContentStore\Apache\bin\tomcat-juli.jar

 

Log4j - Update Log4j, 1 vulnerability

...\Commvault\ContentStore\CVAnalytics\DataCube\...\log4j-core.jar

 

.NET 8 - Update .NET, 104 vulnerabilities

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.18

 

Readiverse Academy Certifications

description of image
Terms & ConditionsAccessibility statement