K11453402 : BIG-IP Cookie encryption security exposure

Security Advisory Description

When HTTP Profile Cookie encryption is enabled, duplicate HTTP cookies may be passed on to back-end servers.

This issue occurs when the following condition is met:

• The virtual server has an HTTP Profile with Cookie Encryption enabled.

Impact

The back-end pool member may receive duplicate HTTP cookies.

Symptoms

As a result of this issue, you may encounter the following symptom:

• Duplicate HTTP Cookies may not be evaluated by the HTTP Profile Cookie Encryption feature.