Home / Security / Advisories / NTAP-20230203-0003

NTAP-20230203-0003 — CVE-2022-3996 OpenSSL Vulnerability in NetApp Products

Published 2023-02-03 · Updated 2025-04-29 · Status: Final · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: Yes

Official advisory: NTAP-20230203-0003 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Baseboard management controllers · SolidFire / NetApp HCI · Cloud Backup / AltaVault / SteelStore · Other NetApp products · ONTAP · SnapManager / Snap utilities | ONTAP-relevant | highest CVSS: 7.5

CVEs in this advisory

CVE-2022-3996 — HIGH · CVSS 7.5 · site index

What the CVE records say

CVE-2022-3996 — If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.

Impact

Successful exploitation of this vulnerability could lead to Denial of Service (DoS). <br><br> ONTAP 9 (formerly Clustered Data ONTAP):<br> Affected only in versions 9.11.1 and higher when SAML is enabled.

Affected products

FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250
Management Services for Element Software and NetApp HCI
NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)
NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
NetApp HCI Baseboard Management Controller (BMC) - H410C
NetApp SMI-S Provider
ONTAP 9
SnapManager for Hyper-V

Official fixes

FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250 — vendor fix ↗
Management Services for Element Software and NetApp HCI — vendor fix ↗
ONTAP 9 — vendor fix ↗
ONTAP 9 — vendor fix ↗
ONTAP 9 — vendor fix ↗

References

https://www.openssl.org/news/secadv/20221213.txt ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.