CVE-2021-22991

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel TMM URI normalization, which may trigger a buffer...

PT-2021-15325

Name of the Vulnerable Software and Affected Versions BIG-IP versions 16.0.x through 16.0.1.0 BIG-IP versions 15.1.x through 15.1.2.0 BIG-IP versions 14.1.x through 14.1.3 BIG-IP versions 13.1.x through 13.1.3.5 BIG-IP versions 12.1.x through 12.1.5.2 BIG-IP versions 11.6.x through 11.6.5.2...

PT-2021-15324

Name of the Vulnerable Software and Affected Versions BIG-IQ versions 6.x through 7.x Description The BIG-IQ HA ElasticSearch service does not implement authentication for clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Recommendations For versions...

PT-2021-15322

Name of the Vulnerable Software and Affected Versions BIG-IQ versions 6.x through 7.x Description The issue concerns BIG-IQ high availability HA when using a Quorum device for automatic failover, which does not implement any form of authentication with the Corosync daemon. Recommendations For...

CVE-2021-23002: Undefined Security Weakness

When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of th...

PT-2021-15321

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.x before 11.6.5.3 F5 BIG-IP versions 12.1.x before 12.1.5.3 F5 BIG-IP versions 13.1.x before 13.1.3.6 F5 BIG-IP versions 14.1.x before 14.1.4 F5 BIG-IP versions 15.1.x before 15.1.2.1 F5 BIG-IP versions 16.0.x before...

PT-2021-15323

Name of the Vulnerable Software and Affected Versions BIG-IQ versions 7.x through 7.x prior to 8.0.0 Description A BIG-IQ Data Collection Device DCD cluster member that receives an undisclosed message may cause the corosync process to abort when set up for auto failover. This behavior may lead to...

PT-2021-15331

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x before 11.6.5.3 BIG-IP versions 12.1.x before 12.1.5.3 BIG-IP versions 13.1.x before 13.1.3.6 BIG-IP versions 14.1.x before 14.1.3.1 BIG-IP versions 15.1.x before 15.1.2 BIG-IP versions 16.0.x before 16.0.1.1 Description...

PT-2021-15326

Name of the Vulnerable Software and Affected Versions BIG-IP versions 14.1.x through 14.1.3 BIG-IP versions 15.0.x through 15.0.x Description The BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection...

PT-2021-15332

Name of the Vulnerable Software and Affected Versions F5 BIG-IQ versions 6.x through 7.x Description The issue arises when using a Quorum device for BIG-IQ high availability HA with automatic failover, where BIG-IQ fails to utilize Transport Layer Security TLS with the Corosync protocol...

CVE-2021-22997: Missing Authentication for Critical Function

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

CVE-2021-22991: Improper Restriction of Operations within the Bounds of a Memory Buffer

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel TMM URI normalization, which may trigger a buffer...

CVE-2021-22990: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the...

CVE-2021-22987: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has an...

CVE-2021-22998: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation SNAT listeners. Note: Software versions which...

CVE-2021-22996: Undefined Security Weakness

On all 7.x versions fixed in 8.0.0, when set up for auto failover, a BIG-IQ Data Collection Device DCD cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service DoS and impact the stability of a BIG-IQ high...

CVE-2021-23004: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP MPTCP forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile...

CVE-2021-22989: Undefined Security Weakness

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility,...

PT-2021-15334

Name of the Vulnerable Software and Affected Versions BIG-IP versions 14.1.4 through 16.0.1.1 Description The issue arises when the Traffic Management Microkernel TMM process handles certain undisclosed traffic, causing it to drop all fragmented IP traffic. Recommendations For BIG-IP version...

PT-2021-15330

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x before 11.6.5.3 BIG-IP versions 12.1.x before 12.1.5.3 BIG-IP versions 13.1.x before 13.1.3.6 BIG-IP versions 14.1.x before 14.1.3.1 BIG-IP versions 15.1.x before 15.1.2 BIG-IP versions 16.0.x before 16.0.1.1 Description...