Home / Security / Advisories / NTAP-20181105-0001

NTAP-20181105-0001 — CVE-2018-0732 OpenSSL Vulnerability in NetApp Products

Published 2018-11-05 · Updated 2024-01-02 · Status: Final · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: Yes

Official advisory: NTAP-20181105-0001 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · Other NetApp products · ONTAP · Cloud Backup / AltaVault / SteelStore · E-Series / SANtricity · OnCommand family · SnapCenter · SnapManager / Snap utilities | ONTAP-relevant | highest CVSS: 7.5

CVEs in this advisory

CVE-2018-0732 — HIGH · CVSS 7.5 · site index

What the CVE records say

CVE-2018-0732 — During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Impact

Successful exploitation of this vulnerability could lead to Denial of Service (DoS).

Affected products

Active IQ Unified Manager for VMware vSphere
Cluster Network Switch (NetApp CN1610)
Data ONTAP Edge
Data ONTAP operating in 7-Mode
NetApp Cloud Backup (formerly AltaVault)
NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)
NetApp Host Agent
NetApp Plug-in for Symantec NetBackup
NetApp SANtricity SMI-S Provider
NetApp SMI-S Provider
NetApp SteelStore Cloud Integrated Storage
NetApp Storage Encryption

Official fixes

Cluster Network Switch (NetApp CN1610) — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP Antivirus Connector — vendor fix ↗
NetApp SANtricity SMI-S Provider — vendor fix ↗
NetApp SMI-S Provider — vendor fix ↗
NetApp Storage Encryption — vendor fix ↗
NetApp VASA Provider for Clustered Data ONTAP 9.7 and above — vendor fix ↗
Active IQ Unified Manager for VMware vSphere — vendor fix ↗
OnCommand Workflow Automation — vendor fix ↗
ONTAP Select Deploy administration utility — vendor fix ↗

References

https://www.openssl.org/news/secadv/20180612.txt ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.