Python vulnerability CVE-2014-9365

F5 Product Development has assigned IDs 739439 and 739444 (BIG-IP, BIG-IQ and F5 iWorkflow) and ID 739439 (Enterprise Manager) to this vulnerability. Additionally, BIG-IP iHealth may list Heuristic H11068141 on the Diagnostics >Identified>Medium page.

To determine if your product and version have been evaluated for this vulnerability, refer to the Applies to (see versions) box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to K51812227: Understanding Security Advisory versioning.

1 The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.

If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in theFixes introduced in column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.

Mitigation

To mitigate this vulnerability, ensure that Python scripts communicate only with trusted servers. Manually download and install update packages instead of using the automated IP Intelligence (IPI) update scripts, which access external update servers. IPI is not enabled by default in the BIG-IP system.

Even though the default setting for IPI is Disabled, the BIG-IP system will be vulnerable if the user installs their own Python scripts that use these vulnerable libraries to make calls to external sites that have X.509 certificates. You must have Admin privileges to install non-standard Python scripts. Be sure to restrict system access to only trusted users.

• K51812227: Understanding Security Advisory versioning
• K41942608: Overview of Security Advisory articles
• K4602: Overview of the F5 security vulnerability response policy
• K4918: Overview of the F5 critical issue hotfix policy
• K9502: BIG-IP hotfix and point release matrix
• K167: Downloading software and firmware from F5
• K9970: Subscribing to email notifications regarding F5 products
• K9957: Creating a custom RSS feed to view new and updated documents
• K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems