Home / Security / Advisories / NTAP-20210622-0003
NTAP-20210622-0003 — CVE-2021-29921 Python Vulnerability in NetApp Products
Published 2021-06-22 · Updated 2024-05-01 · Status: Final · Exploitation: Public · Severity: CRITICAL 9.8 · ONTAP affected: Yes
Product family: Cloud Backup / AltaVault / SteelStore · Other NetApp products · ONTAP | ONTAP-relevant | highest CVSS: 9.8
CVEs in this advisory
- CVE-2021-29921 — CRITICAL · CVSS 9.8 · site index
What the CVE records say
CVE-2021-29921 — In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Impact
Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). <br><br> ONTAP 9 (formerly Clustered Data ONTAP):<br> Affected versions are 9.8 and 9.9.1.
Affected products
- NetApp Cloud Backup (formerly AltaVault)
- NetApp XCP NFS
- NetApp XCP SMB
- ONTAP 9 (formerly Clustered Data ONTAP)
- ONTAP Select Deploy administration utility
Official fixes
- NetApp XCP NFS — vendor fix ↗
- NetApp XCP SMB — vendor fix ↗
- ONTAP Select Deploy administration utility — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
References
- https://bugs.python.org/issue36384 ↗
- https://docs.python.org/3/library/ipaddress.html ↗
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html ↗
What to do
- Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
- If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
- If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
- Harden in parallel: security hardening baseline and ransomware protection on ONTAP.
Related reading
- Common ONTAP problems (FAQ) — plain-language symptoms and fixes
- ONTAP security hardening — baseline lockdown guidance
- Ransomware protection on ONTAP — SnapLock, SnapMirror vaulting, Anomaly Detection
- ONTAP error messages index — EMS/WAFL/NFS/SnapMirror messages
- Every NetApp advisory published in 2021