Home / Security / Advisories / NTAP-20210122-0007
NTAP-20210122-0007 — December 2020 cURL/libcURL Vulnerabilities in NetApp Products
Published 2021-01-22 · Updated 2022-05-27 · Status: Final · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: Yes
Product family: ONTAP · Cloud Backup / AltaVault / SteelStore · SolidFire / NetApp HCI | ONTAP-relevant | highest CVSS: 7.5
CVEs in this advisory
- CVE-2020-8284 — LOW · CVSS 3.7 · site index
- CVE-2020-8285 — HIGH · CVSS 7.5 · site index
- CVE-2020-8286 — HIGH · CVSS 7.5 · site index
What the CVE records say
CVE-2020-8284 — A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-8285 — curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8286 — curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Impact
Successful exploitation of these vulnerabilities could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). <br><br> Clustered Data ONTAP is affected only by CVE-2020-8284 and CVE-2020-8286.
Affected products
- Clustered Data ONTAP
- NetApp Cloud Backup (formerly AltaVault)
- NetApp HCI Compute Node (Bootstrap OS)
- NetApp SolidFire & HCI Management Node
- NetApp SolidFire & HCI Storage Node (Element Software)
- NetApp SolidFire Baseboard Management Controller (BMC)
Official fixes
- Clustered Data ONTAP — vendor fix ↗
- Clustered Data ONTAP — vendor fix ↗
- Clustered Data ONTAP — vendor fix ↗
- Clustered Data ONTAP — vendor fix ↗
- Clustered Data ONTAP — vendor fix ↗
- NetApp SolidFire & HCI Management Node — vendor fix ↗
- NetApp SolidFire & HCI Management Node — vendor fix ↗
- NetApp HCI Compute Node (Bootstrap OS) — vendor fix ↗
- NetApp SolidFire & HCI Storage Node (Element Software) — vendor fix ↗
- NetApp SolidFire & HCI Storage Node (Element Software) — vendor fix ↗
References
- https://curl.se/docs/CVE-2020-8284.html ↗
- https://curl.se/docs/CVE-2020-8285.html ↗
- https://curl.se/docs/CVE-2020-8286.html ↗
What to do
- Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
- If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
- If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
- Harden in parallel: security hardening baseline and ransomware protection on ONTAP.
Related reading
- Common ONTAP problems (FAQ) — plain-language symptoms and fixes
- ONTAP security hardening — baseline lockdown guidance
- Ransomware protection on ONTAP — SnapLock, SnapMirror vaulting, Anomaly Detection
- ONTAP error messages index — EMS/WAFL/NFS/SnapMirror messages
- Every NetApp advisory published in 2021