K000133467: BIG-IP HTTP/2 vulnerability CVE-2023-40534

Security Advisory Description Undisclosed requests can cause the Traffic Management Microkernel TMM to terminate when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server and an iRule using the HTTPREQUEST event or Local Traffic Policy are associated with t...

K26910459: BIG-IP iControl REST vulnerability CVE-2023-42768

Security Advisory Description When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST, the BIG-IP non-admin user can still access the iContro...

K75431121: BIG-IP APM OAuth Bearer with SSO does not process HTTP headers as expected

Security Advisory Description BIG-IP APM OAuth Bearer Single Sign-On SSO may forward HTTP headers as-is without the expected processing when all of the following conditions are met: Bearer SSO configured API Protection profile in use OAuth token failure occurs Impact HTTP headers are forwarded...

K000136185: BIG-IP Edge Client for macOS vulnerability CVE-2023-43611

Security Advisory Description The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. CVE-2023-43611 Note : This vulnerability is due to an incomplete fix for CVE-2023-38418. Impact An attacker with an ability to run...

K000134652: BIG-IP TCP profile vulnerability CVE-2023-40542

Security Advisory Description When TCP Verified Accept is enabled on a TCP profile that is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. CVE-2023-40542 Impact System performance can degrade until the Traffic Management Microkernel TMM...

K47756555: BIG-IP APM Guided Configuration vulnerability CVE-2023-39447

Security Advisory Description When BIG-IP APM Guided Configuration is configured, undisclosed sensitive information may be logged in the restnoded log file. CVE-2023-39447 Impact This vulnerability may allow a high privileged authenticated attacker with local access to the BIG-IP system to read...

K000135689: BIG-IP Configuration utility vulnerability CVE-2023-41373

Security Advisory Description A directory traversal vulnerability exists in the BIG-IP Configuration utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a...

K98334513: BIG-IP DNS TSIG key vulnerability CVE-2023-41253

Security Advisory Description When a BIG-IP DNS or BIG-IP LTM system is enabled with the DNS Services license, and a TSIG key is created, the key is logged in plaintext in the audit log. CVE-2023-41253 Impact An authenticated attacker with at least auditor role privileges can view the TSIG key in...

K000135874: BIG-IP Next SPK SSH vulnerability CVE-2023-45226

Security Advisory Description The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contain hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is expos...

K20850144: BIG-IP and BIG-IQ DB variable vulnerability CVE-2023-41964

Security Advisory Description The BIG-IP and BIG-IQ systems do not encrypt the values of two Database DB variables, a password used for a proxy server connection and a RADIUS/TACACS+ shared secret. CVE-2023-41964 Impact An authenticated attacker may be able to gain access to privileged informatio...

K000132420: BIG-IP IPsec vulnerability CVE-2023-41085

Security Advisory Description When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2023-41085 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote unauthenticated attacker to...

K06110200: BIG-IP and BIG-IQ TACACS+ audit log vulnerability CVE-2023-43485

Security Advisory Description When TACACS+ audit forwarding is configured on a BIG-IP or BIG-IQ system, shared secret is logged in plaintext in the audit log. CVE-2023-43485 Impact An authenticated attacker with at least auditor role privileges can view shared secret. There is no data plane...

K41072952: BIG-IP Appliance mode external monitor vulnerability CVE-2023-43746

Security Advisory Description When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary...

K20307245: BIG-IP tmsh vulnerability CVE-2023-45219

Security Advisory Description Exposure of Sensitive Information vulnerability exists in an undisclosed BIG-IP TMOS Shell tmsh command, which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. CVE-2023-45219 Impact An authenticated attack...

PT-2023-6599 · F5 · Big-Ip Edge Client Installer

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client Installer versions prior to the fixed version Description: The issue is related to insufficient verification of data, which may allow an attacker to elevate their privileges during the installation process on macOS...

PT-2023-28578 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue occurs when a non-admin user is assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration...

F5 BIG-IP 日志信息泄露漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to view TSIG keys in...

F5 BIG-IP 日志信息泄露漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. An information disclosure vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to view shared keys...

PT-2023-6279 · F5 · Big-Ip Local Traffic Manager +18

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client Installer version affected versions not specified BIG-IP Access Policy Manager affected versions not specified BIG-IP Advanced Firewall Manager affected versions not specified BIG-IP Advanced Web Application Firewall affect...

PT-2023-6395 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue concerns an Exposure of Sensitive Information vulnerability existing in an undisclosed BIG-IP TMOS shell tmsh command. This vulnerability may allow an authenticated attacker with...