{"answers":{"affected":"It affects 3 products.","exploited":"There is no known exploitation of CVE-2023-2975 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-2975 is a medium-severity vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 14 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-2975 and fix it if it is affected.\n\nWhat it is: CVE-2023-2975 is a medium-severity vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 14 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-2975 in the wild and no public exploit code.\n\nAffected product: Netapp Ontap Select Deploy Administration Utility. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-2975/ (Markdown: https://insights.sbomify.com/CVE-2023-2975/index.md)","id":"CVE-2023-2975","markdown":"https://insights.sbomify.com/CVE-2023-2975/index.md","name":"CVE-2023-2975","record":{"aliases":["ALPINE-CVE-2023-2975","AZL-47652","CLEANSTART-2026-DD78875","DEBIAN-CVE-2023-2975","GHSA-hpqg-7fjp-436p","JLSEC-2026-240","UBUNTU-CVE-2023-2975"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenSSL cryptographic library","requires_auth":"none","summary":"OpenSSL's AES-SIV implementation fails to authenticate empty associated data entries, allowing attackers to modify or remove them without detection.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[{"product":"management_services_for_element_software_and_netapp_hci","vendor":"netapp"},{"product":"ontap_select_deploy_administration_utility","vendor":"netapp"},{"product":"openssl","vendor":"openssl"}],"cvss":{"score":5.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-354","name":"Improper Validation of Integrity Check Value"}],"description":"Issue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be misled by removing,\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"AES-SIV implementation ignores empty associated data entries","id":"CVE-2023-2975","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"netapp:ontap_select_deploy_administration_utility","products":["netapp:ontap_select_deploy_administration_utility","openssl:openssl"],"type":"weak_cryptography","year":"2023"},"n_packages":0,"n_references":3,"next":{"headline":"Use of temporary directory for file creation in `FileBackedOutputStream` in Guava","id":"CVE-2023-2976"},"packages":[],"prev":{"headline":"quarkus-core vulnerable to client driven TLS cipher downgrading","id":"CVE-2023-2974"},"products":["OpenSSL"],"published":"2023-07-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-23","vendors":["OpenSSL"]},"summary":"OpenSSL's AES-SIV implementation fails to authenticate empty associated data entries, allowing attackers to modify or remove them without detection.","url":"https://insights.sbomify.com/CVE-2023-2975/"}