{"status":"success","advisory":{"_id":"683547225b16347a91c39cf5","kb_acknowledgements":null,"kb_affected_list":["Cluster Network Switch (NetApp CN1610)","Clustered Data ONTAP Antivirus Connector","Data ONTAP Edge","Data ONTAP operating in 7-Mode","NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)","NetApp Host Agent","NetApp Plug-in for Symantec NetBackup","NetApp SMI-S Provider","NetApp VASA Provider for Clustered Data ONTAP 9.6 and above","ONTAP Select Deploy administration utility","OnCommand Workflow Automation","SnapCenter","SnapDrive for Unix","SnapDrive for Windows","SnapProtect","Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.6 and above","Virtual Storage Console for VMware vSphere 9.6 and above"],"kb_bad_data":false,"kb_cve":["CVE-2018-0739","CVE-2018-0733"],"kb_exploitation":"Public","kb_fixes":[{"product":"ONTAP Select Deploy administration utility","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/ontap_select/9.4.28/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"SnapProtect","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2426797.html"},{"product":"SnapDrive for Unix","fixes":[{"link":"https://mysupport.netapp.com/NOW/cgi-bin/license.cgi/download/software/snapdrive_redhatlinux/5.3.2/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"SnapDrive for Windows","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/snapdrive_win/7.1.5P1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp SMI-S Provider","fixes":[{"link":"https://mysupport.netapp.com/products/smis/5.2.5/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Virtual Storage Console for VMware vSphere 9.6 and above","fixes":[{"link":"https://mysupport.netapp.com/NOW/cgi-bin/license.cgi/download/software/vsc_win/7.2.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Data ONTAP operating in 7-Mode","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/ontap/8.2.5P2/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp VASA Provider for Clustered Data ONTAP 9.6 and above","fixes":[{"link":"https://mysupport.netapp.com/NOW/cgi-bin/license.cgi/download/software/vasa_cdot/7.2.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/altavault_ost_win/1.2.4/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.6 and above","fixes":[{"link":"https://mysupport.netapp.com/NOW/cgi-bin/license.cgi/download/software/sra_cmode/7.2.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp Host Agent","fixes":[],"instructions":null,"wontfix":true,"eos_link":"http://mysupport.netapp.com/info/communications/ECMLP2512371.html"},{"product":"SnapCenter","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/snapcenter/4.0/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Data ONTAP Edge","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2630722.html"},{"product":"OnCommand Workflow Automation","fixes":[{"link":"https://mysupport.netapp.com/products/ocwfa/5.0/","cves":[]},{"link":"https://mysupport.netapp.com/products/ocwfa/5.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Clustered Data ONTAP Antivirus Connector","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/ontap_av_connector/1.0.4/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Cluster Network Switch (NetApp CN1610)","fixes":[{"link":"https://mysupport.netapp.com/site/products/all/details/netapp-cluster-switches/downloads-tab/download/63338/1.3.0.3","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp Plug-in for Symantec NetBackup","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2875531.html"}],"kb_impact":"Successful exploitation of these vulnerabilities could lead to unauthorized addition or modification of data or a Denial of Service (DoS).","kb_internal_notes":[{"burt":"1150632","jira":"","product":"Active IQ Unified Manager for VMware vSphere"},{"burt":"1150620","jira":"","product":"Cluster Network Switch (NetApp CN1610)"},{"burt":"1150619","jira":"","product":"Clustered Data ONTAP"},{"burt":"1150618","jira":"","product":"Clustered Data ONTAP Antivirus Connector"},{"burt":"1150621","jira":"","product":"Data ONTAP Edge"},{"burt":"1150622","jira":"","product":"Data ONTAP operating in 7-Mode"},{"burt":"","jira":"","product":"E-Series SANtricity OS Controller Software 11.x"},{"burt":"1150628","jira":"","product":"NetApp Cloud Backup (formerly AltaVault)"},{"burt":"1150617","jira":"","product":"NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)"},{"burt":"","jira":"","product":"NetApp HCI Compute Node (Bootstrap OS)"},{"burt":"","jira":"","product":"NetApp HCI Storage Nodes"},{"burt":"1150625","jira":"","product":"NetApp Host Agent"},{"burt":"1150626","jira":"","product":"NetApp Plug-in for Symantec NetBackup"},{"burt":"","jira":"","product":"NetApp SANtricity SMI-S Provider"},{"burt":"1150623","jira":"","product":"NetApp SMI-S Provider"},{"burt":"","jira":"","product":"NetApp SolidFire & HCI Management Node"},{"burt":"","jira":"","product":"NetApp SolidFire & HCI Storage Node (Element Software)"},{"burt":"1150627","jira":"","product":"NetApp SteelStore Cloud Integrated Storage"},{"burt":"1150629","jira":"","product":"NetApp Storage Encryption"},{"burt":"1150630","jira":"","product":"NetApp VASA Provider for Clustered Data ONTAP 9.6 and above"},{"burt":"1150634","jira":"","product":"ONTAP Select Deploy administration utility"},{"burt":"1150631","jira":"","product":"OnCommand Unified Manager Core Package"},{"burt":"1150633","jira":"","product":"OnCommand Workflow Automation"},{"burt":"1150635","jira":"","product":"Service Processor"},{"burt":"1150636","jira":"","product":"SnapCenter"},{"burt":"1150637","jira":"","product":"SnapDrive for Unix"},{"burt":"1150638","jira":"","product":"SnapDrive for Windows"},{"burt":"1150640","jira":"","product":"SnapProtect"},{"burt":"1150624","jira":"","product":"Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.6 and above"},{"burt":"1150644","jira":"","product":"Storage Replication Adapter for Clustered Data ONTAP for Windows 7.2 and above"},{"burt":"1150642","jira":"","product":"StorageGRID (formerly StorageGRID Webscale)"},{"burt":"1150641","jira":"","product":"StorageGRID9 (9.x and prior)"},{"burt":"1150645","jira":"","product":"Virtual Storage Console for VMware vSphere 9.6 and above"}],"kb_investigating_list":[],"kb_num":"9010000","kb_ref":["https://www.openssl.org/news/secadv/20180327.txt"],"kb_rev_history":[{"comment":"Initial Public Release","date":"20180330","version":"1.0"},{"comment":"NetApp HCI Compute Nodes, NetApp HCI Storage Nodes, NetApp SolidFire Element OS Management Node, NetApp SANtricity SMI-S Provider, NetApp Storage Encryption, and SolidFire Element OS moved to Products Not Affected","date":"20180402","version":"2.0'"},{"comment":"OnCommand Unified Manager for VMware vSphere 7.2 and above moved to Products Not Affected","date":"20180403","version":"3.0'"},{"comment":"Clustered Data ONTAP Antivirus Connector, ONTAP Select Deploy administration utility and SnapDrive for Windows moved to Affected Products","date":"20180409","version":"4.0"},{"comment":"SnapCenter Server moved to Affected Products","date":"20180411","version":"5.0"},{"comment":"SnapCenter Server added to Software Versions and Fixes","date":"20180416","version":"6.0"},{"comment":"Service Processor moved to Affected Products","date":"20180417","version":"7.0"},{"comment":"Updated Workarounds","date":"20180419","version":"8.0"},{"comment":"SnapDrive for Unix moved to Affected Products","date":"20180425","version":"9.0"},{"comment":"Storage Replication Adapter for Clustered Data ONTAP for Windows 4.x and above moved to Products Not Affected.","date":"20180427","version":"10.0"},{"comment":"NetApp SMI-S Provider moved to Affected Products,SnapDrive for Windows added to Software Versions and Fixes","date":"20180607","version":"11.0"},{"comment":"After additional investigation OnCommand Unified Manager for 7-Mode (core package) moved to Products Not Affected.","date":"20180626","version":"12.0"},{"comment":"OnCommand Workflow Automation moved to Affected Products.","date":"20180706","version":"13.0"},{"comment":"ONTAP Select Deploy administration utility added to Software Versions and Fixes","date":"20180712","version":"14.0"},{"comment":"Cluster Network Switch (NetApp CN1610) moved to Affected Products","date":"20180725","version":"15.0"},{"comment":"Cluster Network Switch (NetApp CN1610) moved to Won't Fix status","date":"20180727","version":"16.0"},{"comment":"Clustered Data ONTAP Antivirus Connector added to Software Versions and Fixes","date":"20180803","version":"17.0"},{"comment":"Data ONTAP operating in 7-Mode moved to Affected Products, Data ONTAP Edge moved to Won't Fix status","date":"20180904","version":"18.0"},{"comment":"After additional investigation Service Processor moved to Products Not Affected","date":"20180911","version":"19.0"},{"comment":"NetApp Host Agent moved to Won't Fix status","date":"20181004","version":"20.0"},{"comment":"NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in) added to Software Versions and Fixes","date":"20181113","version":"21.0"},{"comment":"Data ONTAP operating in 7-Mode added to Software Versions and Fixes","date":"20181204","version":"22.0"},{"comment":"SnapDrive for Unix added to Software Versions and Fixes","date":"20190118","version":"23.0"},{"comment":"NetApp VASA Provider for Clustered Data ONTAP 7.0 and above, Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 4.x and above, and Virtual Storage Console for VMware vSphere 7.0 and above added to Software Versions and Fixes","date":"20190131","version":"24.0"},{"comment":"SnapProtect moved to Won't Fix status","date":"20190531","version":"25.0"},{"comment":"NetApp SMI-S Provider added to Software Versions and Fixes","date":"20190724","version":"26.0"},{"comment":"NetApp Cloud Backup (formerly AltaVault) moved to Products Not Affected","date":"20190926","version":"27.0"},{"comment":"NetApp SteelStore Cloud Integrated Storage moved to Products Not Affected","date":"20191001","version":"28.0"},{"comment":"OnCommand Workflow Automation added to Software Versions and Fixes","date":"20191128","version":"29.0"},{"comment":"OnCommand Workflow Automation added to Software Versions and Fixes","date":"20200323","version":"30.0"},{"comment":"NetApp Plug-in for Symantec NetBackup moved to Won't Fix status, Final status","date":"20210105","version":"31.0"},{"comment":"Cluster Network Switch (NetApp CN1610) added to Software Versions and Fixes","date":"20210409","version":"32.0"}],"kb_revised_list":[],"kb_scoring":{"CVE-2018-0733":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","CVE-2018-0739":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},"kb_scoring_calc":[{"cve_id":"CVE-2018-0733","range":"MEDIUM","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"cve_id":"CVE-2018-0739","range":"MEDIUM","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"kb_status":"Final","kb_summary":"Multiple NetApp products incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions 1.0.2b through 1.0.2n and 1.1.0 through 1.1.0g are susceptible to vulnerabilities that may lead to unauthorized addition or modification of data or a Denial of Service (DoS).","kb_title":"March 2018 OpenSSL Vulnerabilities in NetApp Products","kb_unaffected_list":["7-Mode Transition Tool","ATTO FibreBridge - 6500N","Active IQ Unified Manager for Linux","Active IQ Unified Manager for Microsoft Windows","Active IQ Unified Manager for VMware vSphere","Brocade Fabric Operating System Firmware","Cloud Manager","Clustered Data ONTAP","E-Series SANtricity OS Controller Software 11.x","E-Series SANtricity Storage Manager","E-Series SANtricity Web Services (REST API) for Web Services Proxy","Element Plug-in for vCenter Server","FAS/AFF BIOS","Host Utilities - SAN for Linux","Host Utilities - SAN for Windows","MetroCluster Tiebreaker for clustered Data ONTAP","NetApp Cloud Backup (formerly AltaVault)","NetApp Converged Systems Advisor Agent","NetApp HCI Compute Node (Bootstrap OS)","NetApp HCI Storage Nodes","NetApp Manageability SDK","NetApp NFS Plug-in for VMware VAAI","NetApp SANtricity Cloud Connector","NetApp SANtricity SMI-S Provider","NetApp SolidFire & HCI Management Node","NetApp SolidFire & HCI Storage Node (Element Software)","NetApp SteelStore Cloud Integrated Storage","NetApp Storage Encryption","OnCommand API Services","OnCommand Insight","OnCommand Unified Manager Core Package","Open Systems SnapVault Agent","Service Processor","Single Mailbox Recovery","Snap Creator Framework","SnapManager for Exchange","SnapManager for Hyper-V","SnapManager for MS SQL","SnapManager for Oracle","SnapManager for SAP","SnapManager for Sharepoint","Storage Replication Adapter for Clustered Data ONTAP for Windows 7.2 and above","Storage Services Connector","StorageGRID (formerly StorageGRID Webscale)","StorageGRID9 (9.x and prior)","System Manager 9.x"],"kb_workarounds":"<p>\r\nBeginning with OnCommand Workflow Automation for Windows 4.2 the ActiveState ActivePerl software can be upgraded to obtain a newer version of OpenSSL as specified in the product documentation. For assistance with the upgrade, please consult technical support. \r\n</p>\r\n","ntap_advisory_id":"NTAP-20180330-0002","adv_id":"ntap-20180330-0002","published_date":"2018-03-30T00:00:00","updated_date":"2021-04-09T00:00:00","inserted_date":"2025-05-27T05:01:22.465000","modified_date":null}}