Latest netapp element software Vulnerabilities

● CVE-2022-45061

A vulnerability was discovered in Python. A quadratic algorithm exists when processing inputs to the IDNA (RFC 3490) decoder, such that a crafted unreasonably long name being presented to the decoder ...

redhat/python3<0:3.6.8-48.el8_7.1

redhat/python3.9<0:3.9.14-1.el9_1.2

IBM Cloud Pak for Security<=1.10.0.0 - 1.10.11.0

IBM QRadar Suite Software<=1.10.12.0 - 1.10.16.0

redhat/python<3.11.1

redhat/python<3.10.9

and 51 more

● CVE-2022-35252

A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTP(S) server, where it accepts cookies using control codes (byte values below 32), a...

redhat/jbcs-httpd24-curl<0:7.86.0-2.el8

redhat/jbcs-httpd24-curl<0:7.86.0-2.el7

redhat/curl<0:7.61.1-30.el8

redhat/curl<0:7.76.1-23.el9

Apple macOS Ventura<13.1

Apple macOS Monterey<12.6.3

and 33 more

● CVE-2022-32205

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HT...

debian/curl

Apple macOS Ventura<13

Haxx Curl>=7.71.0<7.84.0

Fedoraproject Fedora=35

Debian Debian Linux=11.0

NetApp Clustered Data ONTAP

and 47 more

● CVE-2022-32208

curl. Multiple issues were addressed by updating to curl version 7.84.0.

redhat/jbcs-httpd24-curl<0:7.86.0-2.el8

redhat/jbcs-httpd24-curl<0:7.86.0-2.el7

redhat/curl<0:7.61.1-22.el8_6.4

redhat/curl<0:7.76.1-14.el9_0.5

debian/curl<=7.64.0-4+deb10u2

Apple macOS Ventura<13

and 33 more

● CVE-2022-32207

curl. Multiple issues were addressed by updating to curl version 7.84.0.

redhat/jbcs-httpd24-curl<0:7.86.0-2.el8

redhat/jbcs-httpd24-curl<0:7.86.0-2.el7

redhat/curl<0:7.76.1-14.el9_0.5

debian/curl

Apple macOS Ventura<13

redhat/curl<7.84.0

and 31 more

● CVE-2022-32206

A vulnerability was found in curl. This issue occurs because the number of acceptable "links" in the "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited nu...

redhat/jbcs-httpd24-curl<0:7.86.0-2.el8

redhat/jbcs-httpd24-curl<0:7.86.0-2.el7

redhat/curl<0:7.61.1-22.el8_6.4

redhat/curl<0:7.61.1-18.el8_4.3

redhat/curl<0:7.76.1-14.el9_0.5

debian/curl<=7.64.0-4+deb10u2

and 57 more

● CVE-2022-2068

OpenSSL could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the c_rehash script. By sending a specially-crafted request u...

redhat/jbcs-httpd24-openssl<1:1.1.1k-13.el8

redhat/jbcs-httpd24-openssl<1:1.1.1k-13.el7

redhat/openssl<1:1.1.1k-7.el8_6

redhat/openssl<1:3.0.1-41.el9_0

redhat/jws5-tomcat-native<0:1.2.31-11.redhat_11.el7

redhat/jws5-tomcat-native<0:1.2.31-11.redhat_11.el8

and 95 more

● CVE-2022-1678

An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.

Linux Linux kernel>=4.18<=4.19

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Cloud Volumes Ontap Mediator

NetApp E-Series SANtricity OS Controller>=11.0<=11.70.2

Netapp Element Software

Netapp Hci Management Node

and 20 more

● CVE-2022-21496

An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.

redhat/java<11-openjdk-1:11.0.15.0.9-2.el7_9

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el7_9

redhat/java<1.7.1-ibm-1:1.7.1.5.10-1jpp.1.el7

redhat/java<1.8.0-ibm-1:1.8.0.7.10-1jpp.1.el7

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_5

redhat/java<17-openjdk-1:17.0.3.0.6-2.el8_5

and 48 more

● CVE-2022-21476

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,...

redhat/java<11-openjdk-1:11.0.15.0.9-2.el7_9

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el7_9

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_5

redhat/java<17-openjdk-1:17.0.3.0.6-2.el8_5

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el8_5

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_1

and 168 more

● CVE-2022-21443

An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown att...

redhat/java<11-openjdk-1:11.0.15.0.9-2.el7_9

redhat/java<1.8.0-openjdk-1:1.8.0.332.b09-1.el7_9

redhat/java<1.7.1-ibm-1:1.7.1.5.10-1jpp.1.el7

redhat/java<1.8.0-ibm-1:1.8.0.7.10-1jpp.1.el7

redhat/java<11-openjdk-1:11.0.15.0.9-2.el8_5

redhat/java<17-openjdk-1:17.0.3.0.6-2.el8_5

and 50 more

● CVE-2021-4203

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

redhat/kernel-rt<0:4.18.0-305.57.1.rt7.129.el8_4

redhat/kernel<0:4.18.0-305.57.1.el8_4

Linux Linux kernel<5.15

Linux Linux kernel=5.15

and 175 more

● CVE-2021-3753

A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_io...

Linux Linux kernel<5.15

Redhat Enterprise Linux=7.0

Redhat Enterprise Linux=8.0

Apple iPadOS

Netapp Element Software

Netapp Hci Management Node

and 172 more

● CVE-2021-38199

fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arrang...

Linux Linux kernel<5.13.4

Netapp Hci Bootstrap Os

Netapp Hci Compute Node

Netapp Hci Management Node

Netapp Solidfire

Netapp Element Software

and 125 more

● CVE-2021-38203

btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of fre...

Linux Linux kernel<5.13.4

Netapp Hci Bootstrap Os

Netapp Hci Compute Node

Netapp Hci Management Node

Netapp Solidfire

Netapp Element Software

and 72 more

● CVE-2021-38202

fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is bein...

Linux Linux kernel<5.13.4

Netapp Hci Bootstrap Os

Netapp Hci Compute Node

Netapp Hci Management Node

Netapp Solidfire

Netapp Element Software

and 72 more

● CVE-2021-38160

** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer s...

Linux Linux kernel<5.13.4

Netapp Hci Bootstrap Os

Netapp Hci Compute Node

Netapp Hci Management Node

Netapp Solidfire

Netapp Element Software

and 130 more

● CVE-2021-38201

net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.

redhat/kernel-rt<0:4.18.0-305.17.1.rt7.89.el8_4

redhat/kernel<0:4.18.0-305.17.1.el8_4

Linux Linux kernel<5.13.4

Netapp Hci Bootstrap Os

Netapp Hci Compute Node

Netapp Hci Management Node

and 91 more

● CVE-2020-29368

An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a TH...

redhat/kernel-rt<0:4.18.0-348.rt7.130.el8

redhat/kernel<0:4.18.0-348.el8

redhat/kernel-rt<0:4.18.0-193.87.1.rt13.137.el8_2

redhat/kernel<0:4.18.0-193.87.1.el8_2

redhat/kernel-rt<0:4.18.0-305.57.1.rt7.129.el8_4

redhat/kernel<0:4.18.0-305.57.1.el8_4

and 95 more

● CVE-2020-13143

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attacke...

ubuntu/linux<4.15.0-109.110

ubuntu/linux<5.3.0-62.56

ubuntu/linux<5.4.0-40.44

ubuntu/linux<5.7~

ubuntu/linux<4.4.0-185.215

ubuntu/linux-aws<4.15.0-1077.81

and 153 more

● CVE-2020-12888

Linux Kernel is vulnerable to a denial of service, caused by improper handling of attempts to access disabled memory space by the VFIO PCI driver. By sending a specially-crafted request, a local attac...

redhat/kernel-rt<0:3.10.0-1127.13.1.rt56.1110.el7

redhat/kernel<0:3.10.0-1127.13.1.el7

redhat/kernel-alt<0:4.14.0-115.26.1.el7a

redhat/kernel<0:3.10.0-327.89.1.el7

redhat/kernel<0:3.10.0-514.78.1.el7

redhat/kernel<0:3.10.0-693.71.2.el7

and 183 more

● CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.

ubuntu/linux<4.15.0-96.97

ubuntu/linux<5.3.0-46.38

ubuntu/linux<5.5~

ubuntu/linux<4.4.0-184.214

ubuntu/linux-aws<4.15.0-1065.69

ubuntu/linux-aws<5.3.0-1016.17

and 126 more

● CVE-2020-12771

An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.

ubuntu/linux<4.15.0-115.116

ubuntu/linux<5.4.0-45.49

ubuntu/linux<5.8~

ubuntu/linux<4.4.0-187.217

ubuntu/linux-aws<4.15.0-1080.84

ubuntu/linux-aws<5.4.0-1022.22

and 146 more

● CVE-2020-11884

A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. ...

redhat/kernel<0:4.18.0-193.1.2.el8_2

redhat/kernel<0:4.18.0-80.23.2.el8_0

redhat/kernel<0:4.18.0-147.13.2.el8_1

redhat/kernel<5.7

ubuntu/linux<4.15.0-99.100

ubuntu/linux<5.3.0-51.44

and 107 more

● CVE-2020-12770

An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.

redhat/kernel-rt<0:3.10.0-1160.rt56.1131.el7

redhat/kernel<0:3.10.0-1160.el7

redhat/kernel<0:3.10.0-693.81.1.el7

redhat/kernel<0:3.10.0-957.65.1.el7

redhat/kernel<0:3.10.0-1062.40.1.el7

redhat/kernel-rt<0:4.18.0-240.rt7.54.el8

and 157 more

● CVE-2020-13817

NTP is vulnerable to a denial of service, caused by an issue when relying on unauthenticated IPv4 time sources in ntpd. By predicting transmit timestamps for use in spoofed packets, a remote attacker ...

IBM ISAM<=9.0.7

IBM Security Verify Access<=10.0.0

redhat/ntp<4.2.8

redhat/ntp<4.3.100

NTP ntp<4.2.8

NTP ntp>=4.3.0<4.3.100

and 72 more

● CVE-2020-12653

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of se...

redhat/kernel-rt<0:3.10.0-1127.18.2.rt56.1116.el7

redhat/kernel<0:3.10.0-1127.18.2.el7

redhat/kernel<0:3.10.0-327.90.2.el7

redhat/kernel<0:3.10.0-514.78.1.el7

redhat/kernel<0:3.10.0-693.72.1.el7

redhat/kernel<0:3.10.0-957.58.2.el7

and 43 more

● CVE-2020-10690

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp ...

redhat/kernel-rt<0:3.10.0-1160.rt56.1131.el7

redhat/kernel<0:3.10.0-1160.el7

redhat/kernel-rt<0:4.18.0-193.rt13.51.el8

redhat/kernel<0:4.18.0-193.el8

redhat/kernel<5.5

ubuntu/linux<4.15.0-88.88

and 123 more

● CVE-2019-18683

An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 acc...

ubuntu/linux<4.15.0-88.88

ubuntu/linux<5.3.0-40.32

ubuntu/linux<5.5~

ubuntu/linux<4.4.0-173.203

ubuntu/linux-aws<4.15.0-1060.62

ubuntu/linux-aws<5.3.0-1011.12

and 103 more

● CVE-2019-17498

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a su...

Libssh2 Libssh2<=1.9.0

Fedoraproject Fedora=30

Fedoraproject Fedora=31

openSUSE Leap=15.1

Debian Debian Linux=8.0

Debian Debian Linux=9.0

and 7 more

● CVE-2019-15098

drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.

ubuntu/linux<4.15.0-69.78

ubuntu/linux<5.0.0-35.38

ubuntu/linux<5.4~

ubuntu/linux<4.4.0-168.197

ubuntu/linux-aws<4.15.0-1054.56

ubuntu/linux-aws<5.0.0-1021.24

and 70 more

● CVE-2018-20855

An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to ...

Linux Linux kernel<4.18.7

openSUSE Leap=15.0

openSUSE Leap=15.1

Netapp Active Iq Performance Analytics Services

Netapp Active Iq Unified Manager Vmware Vsphere>=9.5

Netapp Data Availability Services

and 1 more

● CVE-2019-0201

A flaw was found in Apache ZooKeeper. A lack of permission checks while retrieving ACLs allows unsalted hash values to be disclosed for unauthenticated or unprivileged users.

redhat/zookeeper<3.6.0

redhat/zookeeper<3.5.5

redhat/zookeeper<3.4.14

ubuntu/zookeeper<3.4.8-1ubuntu0.1~

ubuntu/zookeeper<3.4.5+dfsg-1ubuntu0.1~

ubuntu/zookeeper<3.4.9-3+

and 34 more

● CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a ...

ubuntu/libxslt<1.1.28-2ubuntu0.2

ubuntu/libxslt<1.1.28-2.1ubuntu0.2

ubuntu/libxslt<1.1.29-5ubuntu0.1

ubuntu/libxslt<1.1.32-2ubuntu0.1

debian/libxslt

Xmlsoft Libxslt<=1.1.33

and 30 more

● CVE-2019-1559

OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. ...

redhat/openssl<0:1.0.1e-58.el6_10

redhat/openssl<1:1.0.2k-19.el7

redhat/jws5-ecj<0:4.12.0-1.redhat_1.1.el6

redhat/jws5-javapackages-tools<0:3.4.1-5.15.11.el6

redhat/jws5-jboss-logging<0:3.3.2-1.Final_redhat_00001.1.el6

redhat/jws5-tomcat<0:9.0.21-10.redhat_4.1.el6

and 226 more

● CVE-2019-9077

An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.

debian/binutils

ubuntu/binutils<2.30-21ubuntu1~18.04.3

ubuntu/binutils<2.33

ubuntu/binutils<2.26.1-1ubuntu1~16.04.8+

GNU Binutils=2.32

Netapp Element Software

and 2 more

● CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI co...

debian/openssh<=1:7.9p1-10+deb10u2<=1:7.9p1-10+deb10u4<=1:8.4p1-5+deb11u2<=1:8.4p1-5+deb11u3<=1:9.2p1-2+deb12u1<=1:9.2p1-2+deb12u2<=1:9.6p1-2

Openbsd Openssh<=7.9

Winscp Winscp<=5.13

Netapp Element Software

Netapp Ontap Select Deploy

Netapp Storage Automation Store

and 4 more

● CVE-2019-3462

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution...

Debian Advanced Package Tool<1.2.30

Debian Advanced Package Tool>=1.3<=1.4.8

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

and 10 more

● CVE-2017-3140

If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5...

ISC BIND>=9.11.0<=9.11.1

ISC BIND=9.9.10

ISC BIND=9.9.10-s1

ISC BIND=9.10.5

ISC BIND=9.10.5-s1

Netapp Data Ontap Edge

and 2 more

● CVE-2018-20685

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the targ...

debian/openssh<=1:7.4p1-10<=1:7.9p1-4<=1:7.4p1-10+deb9u4

debian/openssh

Openbsd Openssh<=7.9

Winscp Winscp<=5.13

Netapp Cloud Backup

Netapp Element Software

and 88 more

● CVE-2018-16888

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service f...

Systemd Project Systemd<237

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.10

Redhat Enterprise Linux=7.0

Netapp Active Iq Performance Analytics Services

and 5 more

● CVE-2018-16866

A flaw was found in systemd-journald. An out-of-bounds read when parsing a crafted syslog message that could lead to information disclosure.

Systemd Project Systemd>=221<=239

Debian Debian Linux=9.0

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=18.10

Netapp Active Iq Performance Analytics Services

and 25 more

● CVE-2018-0735

A flaw was found in OpenSSL versions from 1.1.0 through 1.1.0i inclusive and version 1.1.1. The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An at...

redhat/openssl<1:1.0.2k-16.el7_6.1

redhat/openssl<1:1.1.1c-2.el8

ubuntu/openssl<1.1.0

ubuntu/openssl<1.1.1-1ubuntu2.1

ubuntu/openssl<1.1.1

and 55 more

● CVE-2018-16597

An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.

Linux Linux kernel<4.8

Netapp Active Iq Performance Analytics Services

Netapp Element Software

openSUSE Leap=42.3

● CVE-2018-17182

A security flaw was discovered in the Linux kernel. The vmacache_flush_all() function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain...

Linux Linux kernel>=3.16<3.16.58

Linux Linux kernel>=3.17<3.18.123

Linux Linux kernel>=3.19<4.4.157

Linux Linux kernel>=4.5<4.9.128

Linux Linux kernel>=4.10<4.14.71

Linux Linux kernel>=4.15<4.18.9

and 53 more

● CVE-2017-7657

Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulne...

debian/jetty9

IBM Cognos Command Center<=10.2.4.1

redhat/jetty<9.3.24.

redhat/jetty<9.4.11.

Eclipse Jetty<=9.2.26

Eclipse Jetty>=9.3.0<9.3.24

and 25 more

● CVE-2018-12538

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/...

Eclipse Jetty>=9.4.0<=9.4.8

Netapp E-series Santricity Management Plug-ins

NetApp E-Series SANtricity OS Controller>=11.0<=11.40

Netapp E-series Santricity Web Services Proxy

Netapp Element Software

Netapp Hyper Converged Infrastructure

and 6 more

Latest netapp element software Vulnerabilities

Company

Resources

Contact