Vulnerability Details
During internal testing, a vulnerability was discovered within the Backup Appliance component of Veeam Backup for Google Cloud that allows users to bypass authentication mechanisms.
Severity: CriticalCVSS v3 Score: 10.0Status: Resolved
Solution
A fix has been released to resolve the discovered vulnerability in Veeam Backup for Google Cloud versions 1 and 3. For most users, no actions will be needed, as the Veeam Updater component will have automatically installed this fix during its daily check for updates1. After the fix has been installed, the Backup Appliance will be restarted automatically. For environments where the Veeam Backup for Google Cloud backup appliance does not have access to repository.veeam.com, the fix will have to be manually deployed2 or internet access configured to allow access to the update server.
Verify Update Deployment
The fix for the vulnerability documented in this article is being shipped alongside Veeam Updater version 6.0.0.814 and higher.
The Veeam Updater component version is displayed in the top-right of the web interface.3
More Information
1 The Veeam Updater checks for updates every 24 hours. The Veeam Updater will automatically install updates to the Veeam Updater component and critical updates for other components.
2 The update check requires that the Veeam Backup for Google Cloud backup appliance have internet access and be able to reach repository.veeam.com as documented in the product user guide. If the Veeam Backup for Google Cloud backup appliance does not have internet access, a manual update process is available. Please contact Veeam Support for assistance. After manual updating, the Updater UI will have to be reopened to see the updated version listed.
3 If the Veeam Updater UI is opened before it has updated automatically, clicking "Check for Updates..." will cause the Veeam Updater UI to download the update and become inaccessible while the Backup Appliance is automatically restarted to apply the fix. After reopening the Veeam Updater, the new version number will be displayed.
