K20717585 : BIG-IP APM OAuth vulnerability CVE-2023-22341

Security Advisory Description

When the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate:

• An OAuth Server that references an OAuth Provider
• An OAuth profile with the Authorization Endpoint set to ‘/’
• An access profile that references the above OAuth profile and is associated with an HTTPS virtual server

(CVE-2023-22341)

Impact

Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote unauthenticated attacker to cause a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.