CVE-2022-35243

CVE-2022-35243 affects BIG-IP in Appliance mode where an authenticated Administrator can bypass Appliance mode restrictions via an undisclosed iControl REST endpoint. Affected versions: 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all 13.1.x. Remediation/fixes per F5 ad...

CVE-2022-35240 BIG-IP Message Routing MQTT vulnerability CVE-2022-35240

In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing MR Message Queuing Telemetry Transport MQTT profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software...

CVE-2022-35240

CVE-2022-35240 affects BIG-IP: v16.1.x before 16.1.2.2, v15.1.x before 15.1.6.1, and v14.1.x before 14.1.5, when the Message Routing MQTT profile is configured on a virtual server. Undisclosed requests can cause memory resource utilization to rise, enabling a remote, unauthenticated attacker to d...

CVE-2022-35236

CVE-2022-35236 affects BIG-IP HTTP2 profile when configured on a virtual server, allowing undisclosed traffic to cause increased memory utilization and potential DoS. Affected versions: BIG-IP 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5. Fixes were introduced in 16.1.2.2,...

CVE-2022-35236 HTTP2 profile vulnerability CVE-2022-35236

In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS...

CVE-2022-34865 Traffic intelligence feeds vulnerability CVE-2022-34865

In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support EoTS are...

CVE-2022-34865

CVE-2022-34865 concerns F5 BIG-IP Traffic Intelligence feeds that use HTTPS and fail to verify the remote endpoint identity. Affected are BIG-IP versions: 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all 13.1.x. The consequent risk is potential data poisoning or tampering of in-transit feed ...

CVE-2022-34862

CVE-2022-34862 affects BIG-IP TMM data normalization in LTM when processing undoc’d requests, causing TMM termination (DoS). Affected: BIG-IP versions 13.1.x (13.1.0–13.1.5), 14.1.x (14.1.0–14.1.4), 15.1.x (15.1.0–15.1.6.0/1), 16.1.x (16.1.0–16.1.3). Fixes are in 17.0.0 (for 16.x), 16.1.3.1 (for ...

CVE-2022-34862 TMM vulnerability CVE-2022-34862

In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which...

CVE-2022-34851 BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become unavailable through undisclosed request...

CVE-2022-34851

CVE-2022-34851 affects BIG-IP and BIG-IQ iControl SOAP. An authenticated attacker may render iControl SOAP unavailable via undisclosed requests. Affected versions include BIG-IP 13.1.x, 14.1.x < 14.1.5.1, 15.1.x < 15.1.6.1, 16.1.x < 16.1.3.1, 17.0.x

CVE-2022-34844 BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844

In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver is used with BIG-IP or BIG-IQ on Amazon Web Services AWS systems, undisclosed traffic can cause the Traffic Management...

CVE-2022-34844

The CVE-2022-34844 entry affects F5 BIG-IP and BIG‑IQ on AWS when using the DPDK/ENA driver. The underlying issue causes the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS condition. Affected branches and versions (per the linked advisory) include: BIG-IP 16.x: vulnerable u...

CVE-2022-34655 TMM vulnerability CVE-2022-34655

In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel TMM to terminate. Note: Software versions which have...

CVE-2022-34655

CVE-2022-34655 affects F5 BIG-IP TMM: an iRule with HTTP::payload on a virtual server can cause TMM termination, enabling a network DoS. Affected: BIG-IP 16.0.x before 16.0.1.1; 15.1.x before 15.1.6.1; 14.1.x before 14.1.5. Remediation: upgrade to fixed releases per the advisory K93504311 (fixed ...

CVE-2022-34651

CVE-2022-34651 affects BIG-IP TLS 1.3 in LTM when a TLS 1.3-enabled Client or Server SSL profile is on a virtual server and an iRule calls HTTP::respond. The TMM can terminate, causing DoS due to TMM restart. Affected branches include BIG-IP 16.1.0–16.1.3 (fixed in 16.1.3.1), 15.1.0–15.1.6 (fixed...

CVE-2022-34651 BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651

In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate...

CVE-2022-33968 BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read...

CVE-2022-33968

CVE-2022-33968 affects F5 BIG-IP LTM and APM NTLM: an undisclosed-traffic-induced buffer over-read when LTM monitors or APM SSO are configured on a virtual server and NTLM challenge-response is used. Affected: BIG-IP 13.1.x (all), 14.1.x (before 14.1.5.1), 15.1.x (before 15.1.6.1), 16.1.x (before...

CVE-2022-33962 BIG-IP iRule vulnerability CVE-2022-33962

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings...