PT-2023-21065 · Netapp · Ontap

Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-27317

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5

Description The issue affects SAS-attached FIPS 140-2 drives, causing them to become unlocked after a system reboot, power cycle, or reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.

Recommendations For versions 9.12.1P8, 9.13.1P4, and 9.13.1P5, consider restricting physical access to the drives until a patch is available. As a temporary workaround, consider implementing additional security measures to protect sensitive information stored on the drives. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-27317

Affected Products

Ontap

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-27317 · Security Note
• https://security.netapp.com/advisory/ntap-20231215-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27317 · Vendor Advisory
• https://security.netapp.com/advisory/NTAP-20231215-0001 · Vendor Advisory
• https://twitter.com/CVEnew/status/1735946012756504966 · Twitter Post
• https://t.me/cvenotify/63847 · Telegram Post
• https://t.me/cvenotify/64235 · Telegram Post