K8108 : OpenSSL vulnerability CVE-2007-3108

Security Advisory Description

Note: Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F5 security vulnerability response policy.

F5 products and versions that have been evaluated for this Security Advisory

Vulnerability description and product information

F5 Product Development has determined that the BIG-IP and Enterprise Manager products use a vulnerable version of OpenSSL; however, the vulnerable code is not used in either TMM or in Apache on the BIG-IP system. The vulnerability is considered to be a local vulnerability and cannot be exploited remotely.

Information about this advisory is available at the following locations:

<https://vulners.com/cve/CVE-2007-3108&gt;

F5 Product Development tracked this issue as CR84151 for BIG-IP LTM, GTM, ASM, Link Controller and the WebAccelerator module, and it was fixed in BIG-IP versions 9.3.1 and 9.4.4. For information about upgrading, refer to the BIG-IP LTM, GTM, ASM, Link Controller and WebAccelerator Release Notes.

F5 Product Development tracked this issue as CR84151 for Enterprise Manager, and it was fixed in version 1.6. For information about upgrading, refer to the Enterprise Manager Release Notes.