Home / Security / Advisories / NTAP-20230517-0001
NTAP-20230517-0001 — February 2023 PHP Vulnerabilities in NetApp Products
Published 2023-05-17 · Updated 2023-09-05 · Status: Final · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: Yes
Product family: ONTAP | ONTAP-relevant | highest CVSS: 7.5
CVEs in this advisory
- CVE-2023-0662 — HIGH · CVSS 7.5 · site index
- CVE-2023-0568 — HIGH · CVSS 7.5 · site index
What the CVE records say
CVE-2023-0662 — In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.
CVE-2023-0568 — In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
Impact
Successful exploitation of these vulnerabilities could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).
Affected products
- ONTAP 9 (formerly Clustered Data ONTAP)
Official fixes
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
- ONTAP 9 (formerly Clustered Data ONTAP) — vendor fix ↗
References
- https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv ↗
- https://bugs.php.net/bug.php?id=81746 ↗
What to do
- Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
- If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
- If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
- Harden in parallel: security hardening baseline and ransomware protection on ONTAP.
Related reading
- Common ONTAP problems (FAQ) — plain-language symptoms and fixes
- ONTAP security hardening — baseline lockdown guidance
- Ransomware protection on ONTAP — SnapLock, SnapMirror vaulting, Anomaly Detection
- ONTAP error messages index — EMS/WAFL/NFS/SnapMirror messages
- Every NetApp advisory published in 2023