Embed Notice

Oh, wow.

Only after pestering the Commvault PSIRT did they update the language of their advisory.

While it still incorrectly says that 11.38.0 - 11.38.19 are affected and that 11.38.20 is resolved (it is not), the've added a section below this misinformation to convey the actual state of the world:

11.38.20 is only patched if it has the SP38-CU20-433 and SP38-CU20-436 additional updates installed.

And 11.38.25 is only patched if it has the SP38-CU25-434 and SP38-CU25-438 additional updates installed.

I cannot think of a behavior that is more vindictive to their customers to botch language in an advisory so bad, and also to not bother bumping release versions for the fixes for a CVSS 10 EITW vulnerability. 🤦♂️