K52534925: BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203

Security Advisory Description When a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. CVE-2022-33203 Impact System performance can degrade until the Traffic Management Microkernel TMM...

K53197140: BIG-IP iControl REST and tmsh vulnerabilities CVE-2022-26835

Security Advisory Description Directory traversal vulnerabilities exist in undisclosed iControl REST endpoints and TMOS Shell tmsh commands in F5 BIG-IP Guided Configuration, which may allow an authenticated attacker with at least resource administrator role privileges to read arbitrary files...

K35236639: Supermicro BMC vulnerability

Security Advisory Description F5 is aware of the reports of vulnerabilities in the baseband management controllers BMCs of Supermicro servers. These vulnerabilities allow attackers to easily connect to a server and virtually mount any USB device to the server, remotely over any network, including...

K30444545: libxslt vulnerability CVE-2019-11068

Security Advisory Description libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

K16852653: TMM vulnerability CVE-2022-32455

Security Advisory Description When a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the Traffic Management Microkernel TMM to terminate. CVE-2022-32455 Impact Traffic is disrupte...

K15296: list.jsp XSS vulnerability CVE-2014-3959

Security Advisory Description A cross-site scripting XSS vulnerability exists in list.jsp for the BIG-IP and Enterprise Manager Configuration utilities. CVE-2014-3959 Impact Somelist.jsp parameters may allow an attacker to bypass XSS protection mechanisms using a crafted string. Security Advisory...

K74302282: BIG-IP APM RDP resource security exposure

Security Advisory Description When BIG-IP APM Remote Desktop Protocol RDP is configured, users can bypass RDP resource redirection restrictions between the RDP remote machine and the local machine. This issue occurs when the following condition is met: A BIG-IP APM policy configured with an RDP...

K23203045: BIG-IP Advanced WAF and ASM REST API vulnerability CVE-2021-23014

Security Advisory Description BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API, which might allow authenticated users with guest privileges to upload files. CVE-2021-23014 Impact If an attacker has network access to the BIG-...

K41142448: QEMU vulnerability CVE-2020-27617

Security Advisory Description ethgetgsotype in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol. CVE-2020-27617 Impact BIG-IP This flaw allows a guest user to cause the QEMU proces...

K91171450: BIG-IP engineering hotfix Trusted Platform Module vulnerability CVE-2020-5851

Security Advisory Description On impacted versions and platforms, the Trusted Platform Module TPM system integrity check cannot detect modifications to specific system components. CVE-2020-5851 Impact BIG-IP The Trusted Platform Module TPM on the BIG-IP iSeries platforms i850, i2000, i4000, i5000...

K62750376: RADIUS authentication vulnerability CVE-2018-5515

Security Advisory Description Using RADIUS authentication responses from a RADIUS server with IPv6 addresses may cause TMM to crash, leading to a failover event. CVE-2018-5515 Impact BIG-IP When a BIG-IP system receives a RADIUS authentication response from a IPv6 RADIUS server, the affected syst...

K57555833: BIG-IP APM vulnerability CVE-2022-27634

Security Advisory Description BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. CVE-2022-27634 Impact This vulnerability may allow an authenticated...

K8602: XSS vulnerability viewing logs from the web management interface

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K34652116: BIG-IP APM CRL vulnerability CVE-2018-15326

Security Advisory Description In some situations, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List. CVE-2018-15326. Impact Users with revoked certificates may be able to gain access to the...

K97045220: BIG-IP LTM HTTP/2 desync attacks: malicious CRLF placement security exposure

Security Advisory Description Multiple desync attacks have been discovered. For more information refer to the following related articles: K27144609: Overview of HTTP/2 desync attacks K30341203: BIG-IP LTM and NGINX are not exposed to certain desync attacks K63312282: BIG-IP LTM HTTP/2 desync...

K27551003: The BIG-IP system may not interpret an HTTP request the same way the target web server interprets it

Security Advisory Description This issue occurs when all of the following conditions are met: A virtual server is associated with an HTTP profile. An iRule or LTM policy that uses HTTP header information is associated with the virtual server. The BIG-IP system receives a specially crafted HTTP...

K55376430: NTP vulnerabilities CVE-2020-13817

Security Advisory Description The ntpd in the network time protocol NTP before 4.2.8p14, and in 4.3.x before 4.3.100, allows remote attackers to cause a denial-of-service DoS, either daemon exit or system time change, by predicting transmit timestamps for use in spoofed packets. The victim must b...

K66851119: F5 TMUI XSS vulnerability CVE-2021-22994

Security Advisory Description Undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. CVE-2021-22994 Impa...

K85021277: BIG-IP DNSSEC security exposure

Security Advisory Description When you configure security extensions for DNS DNSSEC on a virtual server, undisclosed requests result in incorrect NSEC3 records returned. This issue occurs when the following conditions are met: You use DNSSEC on an affected version of BIG-IP DNS formerly known as...

K41503304: Advanced WAF, BIG-IP ASM, and NGINX App Protect attack signature bypass security exposure

Security Advisory Description The F5 Advanced Web Application Firewall Advanced WAF, BIG-IP ASM, and NGINX App Protect systems attack signature check may fail to match attack signature 200000128, as expected, for certain undisclosed requests. This issue occurs when all of the following conditions...