Home / Security / Advisories / NTAP-20230725-0004

NTAP-20230725-0004 — CVE-2023-2975 OpenSSL Vulnerability in NetApp Products

Published 2023-07-25 · Updated 2026-03-05 · Status: Interim · Exploitation: Public · Severity: MEDIUM 5.3 · ONTAP affected: Yes

Official advisory: NTAP-20230725-0004 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Baseboard management controllers · SolidFire / NetApp HCI · Cloud Backup / AltaVault / SteelStore · ONTAP · SnapManager / Snap utilities · Other NetApp products | ONTAP-relevant | highest CVSS: 5.3

CVEs in this advisory

CVE-2023-2975 — MEDIUM · CVSS 5.3 · site index

What the CVE records say

CVE-2023-2975 — Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.

Impact

Successful exploitation of this vulnerability could lead to Denial of Service (DoS).

Affected products

FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250
Management Services for Element Software and NetApp HCI
NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)
NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
NetApp HCI Baseboard Management Controller (BMC) - H410C
NetApp HCI Compute Node (Bootstrap OS)
ONTAP Select Deploy administration utility
SnapManager for Hyper-V
Global File Cache

Official fixes

FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250 — vendor fix ↗
Management Services for Element Software and NetApp HCI — vendor fix ↗
ONTAP Select Deploy administration utility — vendor fix ↗

References

https://www.openssl.org/news/secadv/20230714.txt ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.