{"status":"success","advisory":{"_id":"683547235b16347a91c39d39","kb_acknowledgements":null,"kb_affected_list":["E-Series SANtricity Management Plug-ins (VMware vCenter)","E-Series SANtricity OS Controller Software 11.x","E-Series SANtricity Unified Manager and Web Services Proxy","NetApp SANtricity Cloud Connector","NetApp SolidFire & HCI Management Node","NetApp SolidFire & HCI Storage Node (Element Software)","OnCommand System Manager 3.x ","OnCommand Unified Manager Core Package","Snap Creator Framework","SnapCenter","SnapManager for Oracle","SnapManager for SAP"],"kb_bad_data":false,"kb_cve":["CVE-2017-7656","CVE-2017-7657","CVE-2017-7658","CVE-2018-12536","CVE-2018-12538"],"kb_exploitation":"Public","kb_fixes":[{"product":"E-Series SANtricity Management Plug-ins (VMware vCenter)","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2876802.html"},{"product":"E-Series SANtricity OS Controller Software 11.x","fixes":[{"link":"https://mysupport.netapp.com/products/eseries_santricityos/11.50.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"E-Series SANtricity Unified Manager and Web Services Proxy","fixes":[{"link":"https://mysupport.netapp.com/products/eseries_webservices/3.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp SANtricity Cloud Connector","fixes":[{"link":"https://mysupport.netapp.com/products/eseries_cloudconn/4.0/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp SolidFire & HCI Management Node","fixes":[{"link":"https://mysupport.netapp.com/products/solidfire/11.1P1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"OnCommand System Manager 3.x ","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMLP2865102.html"},{"product":"OnCommand Unified Manager Core Package","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/occore_win/5.2.4/","cves":[]},{"link":"https://mysupport.netapp.com/NOW/download/software/occore_lin/5.2.4/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Snap Creator Framework","fixes":[{"link":"https://mysupport.netapp.com/products/snapcreator/4.3.3/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"SnapCenter","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/snapcenter/4.1P3/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"SnapManager for Oracle","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/snapmanager_oracle_unix/3.4.2/","cves":[]},{"link":"https://mysupport.netapp.com/NOW/download/software/snapmanager_oracle_win/3.4.2/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"SnapManager for SAP","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/snapmanager_sap_win/3.4.2/","cves":[]},{"link":"https://mysupport.netapp.com/NOW/download/software/snapmanager_sap_unix/3.4.2/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp SolidFire & HCI Storage Node (Element Software)","fixes":[{"link":"https://mysupport.netapp.com/products/solidfire/11.1P1/","cves":[]},{"link":"https://mysupport.netapp.com/products/hci/1.6/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null}],"kb_impact":"Successful exploitation of these vulnerabilities could lead to disclosure of potentially sensitive information, privilege escalation, unauthorized addition or modification of data or Denial of Service (DoS).","kb_internal_notes":[{"burt":"1193581","jira":"","product":"7-Mode Transition Tool"},{"burt":"1193618","jira":"","product":"Active IQ Unified Manager for Linux"},{"burt":"1193617","jira":"","product":"Active IQ Unified Manager for Microsoft Windows"},{"burt":"1193616","jira":"","product":"Active IQ Unified Manager for VMware vSphere"},{"burt":"1193582","jira":"","product":"E-Series SANtricity Management Plug-ins (VMware vCenter)"},{"burt":"1193585","jira":"","product":"E-Series SANtricity OS Controller Software 11.x"},{"burt":"1193583","jira":"","product":"E-Series SANtricity Unified Manager and Web Services Proxy"},{"burt":"","jira":"SECURITY-288","product":"Element Plug-in for vCenter Server"},{"burt":"1193587","jira":"","product":"MetroCluster Tiebreaker for clustered Data ONTAP"},{"burt":"1193592","jira":"","product":"NetApp BlueXP"},{"burt":"1193589","jira":"","product":"NetApp Cloud Backup (formerly AltaVault)"},{"burt":"","jira":"","product":"NetApp HCI Compute Node (Bootstrap OS)"},{"burt":"1193588","jira":"","product":"NetApp NFS Plug-in for VMware VAAI"},{"burt":"1193584","jira":"","product":"NetApp SANtricity Cloud Connector"},{"burt":"1193599","jira":"","product":"NetApp Service Level Manager"},{"burt":"","jira":"SECURITY-322","product":"NetApp SolidFire & HCI Management Node"},{"burt":"","jira":"SECURITY-235","product":"NetApp SolidFire & HCI Storage Node (Element Software)"},{"burt":"1193590","jira":"","product":"NetApp VASA Provider for Clustered Data ONTAP 9.7 and above"},{"burt":"1193615","jira":"","product":"ONTAP 9 (formerly Clustered Data ONTAP)"},{"burt":"1193598","jira":"","product":"ONTAP Select Deploy administration utility"},{"burt":"1193591","jira":"","product":"OnCommand API Services"},{"burt":"","jira":"ICI-5779","product":"OnCommand Insight"},{"burt":"1193593","jira":"","product":"OnCommand Plug-in for Microsoft"},{"burt":"1193594","jira":"","product":"OnCommand System Manager 3.x "},{"burt":"1193595","jira":"","product":"OnCommand Unified Manager Core Package"},{"burt":"1193596","jira":"","product":"OnCommand Workflow Automation"},{"burt":"1193601","jira":"","product":"Snap Creator Framework"},{"burt":"1193600","jira":"","product":"SnapCenter"},{"burt":"1193602","jira":"","product":"SnapDrive for Unix"},{"burt":"1193603","jira":"","product":"SnapManager for Oracle"},{"burt":"1193604","jira":"","product":"SnapManager for SAP"},{"burt":"1193586","jira":"","product":"Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above"},{"burt":"1193605","jira":"","product":"StorageGRID (formerly StorageGRID Webscale)"},{"burt":"","jira":"","product":"System Manager 9.x"},{"burt":"1193608","jira":"","product":"Virtual Storage Console for VMware vSphere 9.7 and above"}],"kb_investigating_list":[],"kb_num":"9010000","kb_ref":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670","http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00123.html"],"kb_rev_history":[{"comment":"Initial Public Release","date":"20181014","version":"1.0"},{"comment":"StorageGRID Webscale moved to Products Not Affected, OnCommand System Manager (Offbox only) moved to Affected Products","date":"20181015","version":"2.0"},{"comment":"Active IQ Performance Analytics Services, ONTAP Select Deploy administration utility and OnCommand Workflow Automation moved to Products Not Affected","date":"20181016","version":"3.0"},{"comment":"Snap Creator Framework, E-Series SANtricity OS Controller Software 11.x moved to Affected Products and OnCommand Unified Manager for Linux 7.3 and above moved to Products Not Affected","date":"20181022","version":"4.0"},{"comment":"Clarified impacted Jetty versions","date":"20181025","version":"5.0"},{"comment":"E-Series SANtricity Management Plug-ins (VMware vCenter), E-Series SANtricity Web Services (REST API) for Web Services Proxy, SolidFire Element OS, NetApp SANtricity Cloud Connector, NetApp HCI Storage Nodes, and NetApp SolidFire Element OS Management Node moved to Affected Products","date":"20181102","version":"6.0"},{"comment":"OnCommand Unified Manager for Windows 7.3 and above moved to Products Not Affected","date":"20181112","version":"7.0"},{"comment":"SnapCenter Server added to Software Versions and Fixes","date":"20181122","version":"8.0"},{"comment":"OnCommand Unified Manager for 7-Mode (core package) added to Software Versions and Fixes","date":"20181221","version":"9.0"},{"comment":"OnCommand System Manager 3.x moved to Affected Products","date":"20190110","version":"10.0"},{"comment":"MetroCluster Tiebreaker for clustered Data ONTAP moved to Products Not Affected","date":"20190123","version":"11.0"},{"comment":"SnapManager for SAP, SnapManager for Oracle added to Software Versions and Fixes and OnCommand Plug-in for Microsoft moved to Products Not Affected","date":"20190128","version":"12.0"},{"comment":"NetApp VASA Provider for Clustered Data ONTAP 7.2 and above, Virtual Storage Console for VMware vSphere 7.2 and above, and Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 7.2 and above moved to Products Not Affected","date":"20190204","version":"13.0"},{"comment":"7-Mode Transition Tool moved to Products Not Affected","date":"20190220","version":"14.0"},{"comment":"E-Series SANtricity Web Services (REST API) for Web Services Proxy and E-Series SANtricity OS Controller Software 11.x added to Software Versions and Fixes","date":"20190226","version":"15.0"},{"comment":"Snap Creator Framework added to Software Versions and Fixes","date":"20190412","version":"16.0"},{"comment":"Element Software (formerly SolidFire Element OS), Element Software Management Node, NetApp HCI Storage Nodes added to Software Versions and Fixes","date":"20190531","version":"17.0"},{"comment":"NetApp NFS Plug-in for VMware VAAI moved to Products Not Affected","date":"20190628","version":"18.0"},{"comment":"Storage Services Connector moved to Affected Products","date":"20200320","version":"19.0"},{"comment":"NetApp SANtricity Cloud Connector added to Software Versions and Fixes","date":"20200327","version":"20.0"},{"comment":"OnCommand Cloud Manager moved to Products Not Affected","date":"20201124","version":"21.0"},{"comment":"OnCommand System Manager 3.x moved to Won't Fix status, Final status","date":"20210104","version":"22.0"}],"kb_revised_list":[],"kb_scoring":{"CVE-2017-7656":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","CVE-2017-7657":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","CVE-2017-7658":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","CVE-2018-12536":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","CVE-2018-12538":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"kb_scoring_calc":[{"cve_id":"CVE-2017-7656","range":"HIGH","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"cve_id":"CVE-2017-7657","range":"CRITICAL","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"cve_id":"CVE-2017-7658","range":"CRITICAL","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"cve_id":"CVE-2018-12536","range":"MEDIUM","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"cve_id":"CVE-2018-12538","range":"HIGH","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"kb_status":"Final","kb_summary":"Multiple NetApp products incorporate the Eclipse Jetty server. Eclipse Jetty versions 9.x through 9.2.24, 9.3.23 and 9.4.10  are susceptible to vulnerabilities which when successfully exploited could lead to disclosure of potentially sensitive information, privilege escalation, unauthorized addition or modification of data or Denial of Service (DoS).","kb_title":"September 2018 Eclipse Jetty Vulnerabilities in NetApp Products","kb_unaffected_list":["7-Mode Transition Tool","Active IQ Unified Manager for Linux","Active IQ Unified Manager for Microsoft Windows","Active IQ Unified Manager for VMware vSphere","Brocade Fabric Operating System Firmware","Element Plug-in for vCenter Server","FAS/AFF BIOS - 8300/8700/A400/C400","FAS/AFF Baseboard Management Controller (BMC) - A320/C190/A220/FAS2720/FAS2750/A800/C800/A150","FAS/AFF Service Processor - 8080/8060/8040/8020","Host Utilities - SAN for Linux","Host Utilities - SAN for Windows","MetroCluster Tiebreaker for clustered Data ONTAP","NetApp BlueXP","NetApp Cloud Backup (formerly AltaVault)","NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)","NetApp Converged Systems Advisor Agent","NetApp HCI Compute Node (Bootstrap OS)","NetApp HCI Compute Node BIOS","NetApp Manageability SDK","NetApp NFS Plug-in for VMware VAAI","NetApp ONTAP PowerShell Toolkit (PSTK)","NetApp Service Level Manager","NetApp VASA Provider for Clustered Data ONTAP 9.7 and above","ONTAP 9 (formerly Clustered Data ONTAP)","ONTAP Antivirus Connector","ONTAP Select Deploy administration utility","OnCommand API Services","OnCommand Insight","OnCommand Plug-in for Microsoft","OnCommand Workflow Automation","Single Mailbox Recovery","SnapDrive for Unix","SnapManager for Hyper-V","Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above","StorageGRID (formerly StorageGRID Webscale)","StorageGRID Baseboard Management Controller (BMC)","System Manager 9.x","Virtual Storage Console for VMware vSphere 9.7 and above"],"kb_workarounds":"None at this time.","ntap_advisory_id":"NTAP-20181014-0001","adv_id":"ntap-20181014-0001","published_date":"2018-10-14T00:00:00","updated_date":"2021-01-04T00:00:00","inserted_date":"2025-05-27T05:01:23.551000","modified_date":null}}