With the recent announcement of the Volt Typhoon cyber campaign, our team has conducted a thorough security assessment of Commvault and Metallic services and have found no impact to the security, privacy, or integrity of your data backups. As and when we have an updated version of the third-party component, we will issue an update for the same. However, our initial analysis indicate that the vulnerability does not affect Commvault products.Īs a precautionary measure, we are monitoring the third-party components for any fixes. We are aware that some third-party components that we use include the libwebp package. To fix this vulnerability, install the following updates for the affected Platform Release on the Web Server: We have issued an update to replace the older versions of the Apache ActiveMQ component with version 5.18.3 on the Web Server. The vulnerability affects the Commvault Web Server.

CV_2023_11_1: Remote Code Execution Vulnerability in Apache ActiveMQ This vulnerability does not affect Commvault products.Īs a precautionary measure, we will upgrade the cURL component in the product in an upcoming maintenance release. Security Advisories CV_2023_11_2: Heap Based Buffer Overflow Vulnerability in cURL To report a new vulnerability, click here.

Software Upgrades, Updates, and Uninstallation >Ĭommvault for Managed Service Providers (MSPs) > HyperScale Platform Versions and Images >

Instal the new for apple Q-Dir 11.32