NetApp Black Box — ONTAP knowledge base

Home / Security / Advisories / NTAP-20250502-0006

NTAP-20250502-0006 — April 2025 MySQL 8.0.41, 8.4.4 and 9.2.0 Vulnerabilities in NetApp Products

Published 2025-05-02 · Updated 2026-01-23 · Status: Interim · Exploitation: Public · Severity: MEDIUM 4.1 · ONTAP affected: No — other NetApp product

Official advisory: NTAP-20250502-0006 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · OnCommand family · SnapCenter  |  other NetApp product  |  highest CVSS: 4.1

CVEs in this advisory

What the CVE records say

CVE-2024-13176 — Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Impact

Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, a partial denial of service (partial DOS) of MySQL Server, or unauthorized read, update, insert or delete access to some of MySQL Server accessible data.

Affected products

Official fixes

References

What to do

  1. Compare your installed product and version against the affected list above and the official advisory's affected-versions table.
  2. Apply the fixed release named in the official advisory, or the documented workaround if no fix ships yet.
  3. Limit management-plane exposure (BMC/management interfaces, web UIs, SNMP) until patched.
  4. Track follow-ups in the site CVE index and the security RSS feed.

Related reading

Browse all ONTAP CVEs → · Security hub