Description
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.
CVSS breakdown
CVSS 3.1
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- NETAPP / ONTAP 99.12.1P8 – 9.12.1P8
- NETAPP / ONTAP 99.13.1P4 – 9.13.1P4
- NETAPP / ONTAP 99.13.1P5 – 9.13.1P5
References
Updated 46m ago · 8 sources