Netapp Clustered Data Ontap Antivirus Connector vulnerabilities

23 CVEs affecting Netapp Clustered Data Ontap Antivirus Connector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-40304, published 2022-11-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2022-0778, published 2022-03-15. High severity, CVSS 7.5. EPSS: 73.2% chance of exploitation in the next 30 days. The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates…
CVE-2021-3712, published 2021-08-24. High severity, CVSS 7.4. EPSS: 50.4% chance of exploitation in the next 30 days. ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C…
CVE-2022-40303, published 2022-11-23. High severity, CVSS 7.5. EPSS: 41.4% chance of exploitation in the next 30 days. An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an…
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2021-3518, published 2021-05-18. High severity, CVSS 8.8. EPSS: 21.9% chance of exploitation in the next 30 days. There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2021-3517, published 2021-05-19. High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days. There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…

Latest

CVE-2022-40304, published 2022-11-23. High severity, CVSS 7.8. EPSS: 5.8% chance of exploitation in the next 30 days. An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can…
CVE-2022-2097, published 2022-07-05. Medium severity, CVSS 5.3. EPSS: 4.9% chance of exploitation in the next 30 days. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data…
CVE-2022-1473, published 2022-05-03. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding…
CVE-2022-1434, published 2022-05-03. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by…
CVE-2022-1343, published 2022-05-03. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a…
CVE-2022-29824, published 2022-05-03. Medium severity, CVSS 6.5. EPSS: 3.8% chance of exploitation in the next 30 days. In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation…
CVE-2022-23308, published 2022-02-26. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.