Sign In
Forgot Password

Don’t have an account? Create One.

NetBackup 8.2 / 3.2 HotFix - EEB Bundle for nbdeployutil, netbackup.war, libVdb, and 2.17.1 Apache Log4j addressing CVE-2021-44228 and CVE-2021-45046 (Etrack 4021776)

HotFix Critical

Abstract

Bundling of fixes for nbdeployutil, netbackup.war and libVdb and fix for CVE-2021-44228 and CVE-2021-45046

Description

Veritas Bug ID: ET 4021776

 

Version:  NetBackup 8.2

 

Fixes Included: 

 

ET 3971241: RBK [Smart Meter] Usage trend data is not being displayed on webui for my MSCS clustered master
ET 3976758: The nbdeployutil capacity report fails when a backup image has no data fragments
ET 3979482: Nbdeployutil traditional report not counting MS-SQL-Server as a DB Pack
ET 3979556: Failed to get certain policy's info - getPolicyByName(ora_act3) - Error creating policy json payload.
ET 3980565: nbdeployutil overlap detection not working for directories with similar kind of names
ET 3981361: NBU-80579 : Add performance metrics logging in nbdeployutil
ET 3981595: nbdeployutil report shows incorrect number of VM clients
ET 3981724: NBU - 81472 : SQL statements : use transactions during sqlite based processing
ET 3984681: Asset group preview oDataQueryFilter cannot filter on power state
ET 3985303: NetBackup Manual Backup API Not Working for NDMP Policies
ET 3985912: Error 8021: unable to validate the user or group when clicked on certificate management
ET 3985946: /config/policies/: 501 NOT_IMPLEMENTED, Error: Policy API for the specified operation
ET 3986264: [8.2][VMware] Irrespective of policy type, if VM data is getting protected then it should be treated under 'virtual' workload.
ET 3994645: Request for EEB from 3978844 for NBU version 8.2
ET 3994999: nbdeployutil capacity report shows duplicate client entries and causing discrepancy 

 

Version 4 Adds:
1.Fix for CVE-2021-44228 and CVE-2021-45046 - Update NetBackup with Apache Log4j 2.17.1.
2. Support for installation of EEB on Solaris 10 platform (both Solaris-SPARC and Solaris-x86-64).

 

NOTE : If you have installed UPD868820, please uninstall 4021776 v2 before installing UPD557376.

 

IMPORTANT NOTE: 
1.As a standard practice for deploying any further revisions of this EEB in future, refer the EEB Readme for any additional actions required. 
2. If you have already implemented the mitigation steps documented in UPD464986, you DO NOT have to revert those steps before installing the EEB.

Install on: Server (Master/Primary) or Media

 

Installation Instructions:

 

  • Because this is a bundle, please stop NetBackup services before applying the hotfix.
  • Run EEB installer with -create option

      e.g. On Linux/Unix - ./eebinstaller_4021776_4_linuxR_x86 -create

             On Windows - eebinstaller_4021776_4_AMD64.exe -create

  • Check NetBackup services and re-start them if necessary

 

Installation Instruction links:  

 

Using the NetBackup Emergency Engineering Binary (EEB) installer 
https://www.veritas.com/docs/100019405

 

Installing EEBs on a NetBackup 52x0 / 5330 Appliance
https://www.veritas.com/docs/100023444

 

Downloads:

NB_8.2_ET4021776_4.zip
NBAPP_EEB_ET4021776-3.2.0.0-4.x86_64.rpm
VRTSflex-nb_EEB_ET4021776-8.2-4.x86_64.rpm

 

Binary Package Contents and checksums for all files (cksum):

 

File                                                                           Checksum                   Byte count

linuxR_x86/netbackup.war 453140535 66623966
linuxR_x86/nbdeployutil 1712914912 6763990
linuxR_x86/nbwss.war 968789403 23210520
linuxR_x86/nbwebservice.war 165849837 26871003
linuxR_x86/log4j-core-2.17.1.jar 1147346345 1790452
linuxR_x86/log4j-api-2.17.1.jar 3934950123 301873
linuxR_x86/libVdb.so 223287042 1120560
linuxR_x86/preprocess_install_4021776.sh 2701758328 2414
linuxR_x86/log4j-web-2.17.1.jar 1249241531 35961
linuxR_x86/cssclegacy.war 954792402 56673318
linuxR_x86/ROOT.war 954792402 56673318
linuxR_x86/install-4021776_eebi_nbwmc.sh 3574384124 14306
AMD64/preprocess_install_4021776.exe 57468650 5630476
AMD64/netbackup.war 453140535 66623966
AMD64/nbwss.war 968789403 23210520
AMD64/nbwebservice.war 165849837 26871003
AMD64/log4j-core-2.17.1.jar 1147346345 1790452
AMD64/nbdeployutil.exe 3056478434 11412526
AMD64/log4j-api-2.17.1.jar 3934950123 301873
AMD64/libVdb.dll 2949982423 966656
AMD64/cssclegacy.war 954792402 56673318
AMD64/ROOT.war 954792402 56673318
AMD64/log4j-web-2.17.1.jar 1249241531 35961
AMD64/install-4021776_eebi_nbwmc.ps1 251265734 14349
linuxS_x86/netbackup.war 453140535 66623966
linuxS_x86/nbdeployutil 239213111 6802282
linuxS_x86/nbwss.war 968789403 23210520
linuxS_x86/nbwebservice.war 165849837 26871003
linuxS_x86/log4j-core-2.17.1.jar 1147346345 1790452
linuxS_x86/log4j-api-2.17.1.jar 3934950123 301873
linuxS_x86/libVdb.so 2869392392 1142669
linuxS_x86/preprocess_install_4021776.sh 2701758328 2414
linuxS_x86/log4j-web-2.17.1.jar 1249241531 35961
linuxS_x86/cssclegacy.war 954792402 56673318
linuxS_x86/ROOT.war 954792402 56673318
linuxS_x86/install-4021776_eebi_nbwmc.sh 3574384124 14306
solaris_x86/netbackup.war 453140535 66623966
solaris_x86/nbdeployutil 2145969214 6181496
solaris_x86/nbwss.war 968789403 23210520
solaris_x86/nbwebservice.war 165849837 26871003
solaris_x86/log4j-core-2.17.1.jar 1147346345 1790452
solaris_x86/log4j-api-2.17.1.jar 3934950123 301873
solaris_x86/libVdb.so 175166368 1910368
solaris_x86/preprocess_install_4021776.sh 2584868715 2417
solaris_x86/log4j-web-2.17.1.jar 1249241531 35961
solaris_x86/cssclegacy.war 954792402 56673318
solaris_x86/ROOT.war 954792402 56673318
solaris_x86/install-4021776_eebi_nbwmc.sh 3574384124 14306
solaris/netbackup.war 453140535 66623966
solaris/nbdeployutil 1525533352 6557919
solaris/nbwss.war 968789403 23210520
solaris/nbwebservice.war 165849837 26871003
solaris/log4j-core-2.17.1.jar 1147346345 1790452
solaris/log4j-api-2.17.1.jar 3934950123 301873
solaris/libVdb.so 3946049514 1450472
solaris/preprocess_install_4021776.sh 2584868715 2417
solaris/log4j-web-2.17.1.jar 1249241531 35961
solaris/cssclegacy.war 954792402 56673318
solaris/ROOT.war 954792402 56673318
solaris/install-4021776_eebi_nbwmc.sh 3574384124 14306


Recommended service state:

Stop all NetBackup services before applying this hotfix.

Applies to the following product releases

Update files

File name Description Version Platform Size

Knowledge base

71
2022-12-05

About Apache Log4j Vulnerabilities Apache Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services. Veritas is tracking the recently announced vulnerabilities in Apache’s Log4j. All Veritas Pro...