NetApp Black Box — ONTAP knowledge base

Home / Security / Advisories / NTAP-20220121-0008

NTAP-20220121-0008 — January 2022 MySQL Server Vulnerabilities in NetApp Products

Published 2022-01-21 · Updated 2022-09-01 · Status: Final · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: No — other NetApp product

Official advisory: NTAP-20220121-0008 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · OnCommand family · SnapCenter  |  other NetApp product  |  highest CVSS: 7.5

CVEs in this advisory

What the CVE records say

CVE-2021-22946 — A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Impact

Successful exploitation of these vulnerabilities may lead to unauthorized takeover of MySQL Server, unauthorized read or modification access to a subset or all of the MySQL Server accessible data, or to a hang or frequently repeatable crash (partial or complete DoS) of MySQL Server.

Affected products

Official fixes

References

What to do

  1. Compare your installed product and version against the affected list above and the official advisory's affected-versions table.
  2. Apply the fixed release named in the official advisory, or the documented workaround if no fix ships yet.
  3. Limit management-plane exposure (BMC/management interfaces, web UIs, SNMP) until patched.
  4. Track follow-ups in the site CVE index and the security RSS feed.

Related reading

Browse all ONTAP CVEs → · Security hub