Home / Security / Advisories / NTAP-20200911-0004

NTAP-20200911-0004 — CVE-2020-1968 OpenSSL Vulnerability in NetApp Products

Published 2020-09-11 · Updated 2024-01-02 · Status: Final · Exploitation: Public · Severity: LOW 3.7 · ONTAP affected: Yes

Official advisory: NTAP-20200911-0004 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · E-Series / SANtricity · Cloud Backup / AltaVault / SteelStore · Other NetApp products · SolidFire / NetApp HCI · ONTAP · SnapManager / Snap utilities | ONTAP-relevant | highest CVSS: 3.7

CVEs in this advisory

CVE-2020-1968 — LOW · CVSS 3.7 · site index

What the CVE records say

CVE-2020-1968 — The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information. <br><br> Clustered Data ONTAP disables DH ciphers by default beginning with version 9.5.

Affected products

Active IQ Unified Manager for VMware vSphere
E-Series SANtricity OS Controller Software 11.x
NetApp Cloud Backup (formerly AltaVault)
NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)
NetApp Plug-in for Symantec NetBackup
NetApp SMI-S Provider
NetApp SolidFire Baseboard Management Controller (BMC)
ONTAP 9 (formerly Clustered Data ONTAP)
ONTAP Antivirus Connector
SnapDrive for Unix
SnapDrive for Windows

Official fixes

Active IQ Unified Manager for VMware vSphere — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
ONTAP Antivirus Connector — vendor fix ↗
E-Series SANtricity OS Controller Software 11.x — vendor fix ↗
NetApp SMI-S Provider — vendor fix ↗
SnapDrive for Unix — vendor fix ↗
SnapDrive for Windows — vendor fix ↗

References

https://www.openssl.org/news/secadv/20200909.txt ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.