Bulletin ID: NTAP-SB-20211028-0001 Version:1.0 Last Updated: 20211028

Applies To

All NetApp products

NOTE: This content formerly existed as a Knowledgebase article.

• NetApp takes the security of our products very seriously and is committed to resolving vulnerabilities to meet the needs of our users and the broader technology community.
• As a result of a continually changing threat landscape, NetApp is updating its Product Security Vulnerability Handling and Response Policy.
• NetApp has stopped maintaining the static tables that previously existed on the Scanner Results Knowledgebase article page.
• Recognizing that users are still interested in information related to potential security vulnerabilities, Common Vulnerability Exposure (CVE) identifiers are searchable in our Bug Tools, Knowledgebase, and Support sites.
• Our current Security policy is available for review on the NetApp Security landing page: https://security.netapp.com/

Current Advisory and Notice Documents

• This page will not be updated for new CVE IDs.
• Security advisories for announced vulnerabilities can be located here: https://security.netapp.com/advisory/
• The Support and Security Advisory sites should become the first stop when searching for CVE IDs impacting NetApp products.
• The following are tables that can help you understand legacy security vulnerabilities related to NetApp products that third-party security scanners might report.
• TABLE A describes CVE IDs that identify security vulnerabilities applicable to a NetApp product.
• TABLE B describes CVE IDs that identify security vulnerabilities that might be reported by vulnerability scanners.
• These vulnerabilities constitute ‘false positives’ reported by vulnerability scanners for user-shipped releases and thus are not believed to represent security exposures for the NetApp products.
• The columns display the CVE number and the NetApp bug tracking number (referred to as a tracking ID on other security pages) where possible, or a title where a bug tracking number is not available.
• It is strongly recommended that end users implement layers of security following security best-practices, including running antivirus tools on the data.
• NetApp storage systems function like file systems to any attached clients.
• While NetApp products might not propagate a given issue, the files and other data objects stored on a NetApp storage system can still be affected by an infected client.

TABLE A: Applicable CVE IDs

• The listed CVE IDs might have been applicable to at least one release of Data ONTAP.
• The Public Report for the provided bug tracking number will show the first ‘fixed release’ when the suspected vulnerability was remediated as well as the subsequent releases that are not subject to the identified vulnerability.

Data ONTAP

Management Tools and Client Products

TABLE B: False-Positive and Never Applicable CVE IDs

These CVE IDs are either ‘false positives’ reported by vulnerability scanners or were never applicable to user-shipping versions of the respective NetApp products.

Data ONTAP

Management Tools and Client Products