CVE-2022-33962

CVE-2022-33962 affects BIG-IP iRules: the node command may bypass access controls on a self IP, enabling privilege escalation for an authenticated attacker with iRules Manager role. Affected branches include BIG-IP all modules: 17.x (vulnerable), 16.x, 15.x, 14.x, and 13.x. Remediation: apply fix...

CVE-2022-33947

CVE-2022-33947 affects BIG-IP DNS TMUI (TMUI/DNS) in BIG-IP versions 16.0.x–16.1.2, 15.1.x, 14.1.x and 13.1.x; an authenticated operator can cause Tomcat restart and perform unauthorized DNS requests via undisclosed TMUI requests. Root cause: deserialization issue in TMUI leading to control-plane...

CVE-2022-33947 BIG-IP DNS TMUI Vulnerability CVE-2022-33947

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface TMUI that allows an authenticated attacker with at least operator role privileges to...

CVE-2022-33203

CVE-2022-33203 affects BIG-IP APM and F5 SSL Orchestrator when an APM policy uses a Service Connect agent on a virtual server. The issue allows undisclosed requests to cause memory resource utilization to rise, leading to degraded performance or DoS. Affected versions are BIG-IP 16.1.x before 16....

CVE-2022-33203 BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have...

CVE-2022-32455 TMM vulnerability CVE-2022-32455

In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the...

CVE-2022-32455

CVE-2022-32455 affects F5 BIG-IP TMM when a LTM Client SSL profile on a virtual server uses client certificate authentication with session tickets enabled. Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS as the TMM restarts. Affected branch...

CVE-2022-31473 BIG-IP APM Appliance mode vulnerability CVE-2022-31473

In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mode restrictions due to a directory traversal vulnerability in an undisclosed page within iApps. A successful exploit can allow the attacker...

CVE-2022-31473

CVE-2022-31473 affects BIG-IP APM in Appliance mode. In 16.1.x before 16.1.1 and 15.1.x before 15.1.4, an authenticated attacker could bypass Appliance mode restrictions via a directory traversal vulnerability in an undisclosed iApps page, crossing a security boundary. The F5 advisory K34893234 s...

PT-2022-22955 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.x BIG-IP versions 14.1.x through 14.1.5.0 BIG-IP versions 15.1.x through 15.1.6.0 BIG-IP versions 16.1.x through 16.1.3.0 Description: An authenticated attacker with Resource Administrator or Manager privileges can create...

PT-2022-22648 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 14.1.x through 14.1.5 BIG-IP versions 15.1.x through 15.1.6.1 BIG-IP versions 16.1.x through 16.1.2.2 Description: When the Message Routing MR Message Queuing Telemetry Transport MQTT profile is configured on a virtual server,...

PT-2022-22400 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.x BIG-IP versions 14.1.x before 14.1.5 BIG-IP versions 15.1.x before 15.1.6.1 BIG-IP versions 16.1.x before 16.1.3.1 Description: When an LTM virtual server is configured to perform normalization, undisclosed requests can...

PT-2022-22391 · Amazon +1 · Amazon Web Services +4

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 15.1.x through 15.1.6.0 F5 BIG-IP versions 16.1.x through 16.1.3.0 F5 BIG-IQ versions 8.x Description: The issue arises when the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver is used with BIG-IP or BIG-...

PT-2022-21936 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 13.1.x F5 BIG-IP versions 14.1.x through 14.1.5.0 F5 BIG-IP versions 15.1.x through 15.1.6.0 F5 BIG-IP versions 16.1.x through 16.1.3.0 F5 BIG-IP versions 17.0.x through 17.0.0.0 Description: The issue allows an attacker to...

PT-2022-21330 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.x BIG-IP versions 14.1.x before 14.1.5 BIG-IP versions 15.1.x before 15.1.6.1 BIG-IP versions 16.1.x before 16.1.2.2 Description: When a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client...

PT-2022-20751 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 15.1.x through 15.1.3 BIG-IP versions 16.1.x through 16.1.0 Description: An authenticated attacker may be able to bypass Appliance mode restrictions due to a directory traversal vulnerability in an undisclosed page within iApp...

PT-2022-21931 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 13.1.x F5 BIG-IP versions 14.1.x through 14.1.4 F5 BIG-IP versions 15.1.x through 15.1.5 F5 BIG-IP versions 16.1.x through 16.1.2 Description: A vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management...

Vulnerabilities fixed in BIG-IP

F5 has fixed vulnerabilities in BIG-IP. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS. Manipulation of data Circumvention of security measure Access to system data Increased user privileges F5 has released...

PT-2022-22645 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 14.1.x through 14.1.5 BIG-IP versions 15.1.x through 15.1.6.1 BIG-IP versions 16.1.x through 16.1.2.2 Description: When an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory...

PT-2022-22273 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 14.1.x through 14.1.5 BIG-IP versions 15.1.x through 15.1.6.1 BIG-IP versions 16.0.x through 16.0.1.1 Description: When an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can...