Home / Security / Advisories / NTAP-20220715-0011

NTAP-20220715-0011 — CVE-2022-2097 OpenSSL Vulnerability in NetApp Products

Published 2022-07-15 · Updated 2025-03-25 · Status: Final · Exploitation: Public · Severity: MEDIUM 5.3 · ONTAP affected: Yes

Official advisory: NTAP-20220715-0011 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · Brocade SAN firmware · Cloud Backup / AltaVault / SteelStore · SolidFire / NetApp HCI · Other NetApp products · ONTAP · SnapCenter · SnapManager / Snap utilities | ONTAP-relevant | highest CVSS: 5.3

CVEs in this advisory

CVE-2022-2097 — MEDIUM · CVSS 5.3 · site index

What the CVE records say

CVE-2022-2097 — AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information.

Affected products

Active IQ Unified Manager for VMware vSphere
Brocade Fabric Operating System Firmware
NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)
NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
NetApp HCI Baseboard Management Controller (BMC) - H410C
NetApp SMI-S Provider
ONTAP Antivirus Connector
ONTAP Select Deploy administration utility
SnapCenter
SnapManager for Hyper-V

Official fixes

Active IQ Unified Manager for VMware vSphere — vendor fix ↗
Active IQ Unified Manager for VMware vSphere — vendor fix ↗
Active IQ Unified Manager for VMware vSphere — vendor fix ↗
ONTAP Antivirus Connector — vendor fix ↗
ONTAP Select Deploy administration utility — vendor fix ↗
SnapCenter — vendor fix ↗

References

https://www.openssl.org/news/secadv/20220705.txt ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.