F5 Networks BIG-IP : BIG-IP DoS profile vulnerability (K88474783)

Under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied. CVE-2020-5879 Impact The affected system sends some requests to the back-end server without encryption, possibly leaking sensitive data. Therequests...

F5 Networks BIG-IP : TMM vulnerability (K35750231)

Traffic Management Microkernel TMMmay restart on BIG-IP Virtual Edition VEwhile processing unusual IP traffic.CVE-2020-5878 Impact The BIG-IP VE system may temporarily fail to process traffic as it recovers from a TMMrestart. If the BIG-IP VE system is configured for high availability HA, it fail...

F5 Networks BIG-IP : BIG-IP crypto driver vulnerability (K63558580)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5 / 13.1.3.2 / 14.0.1.1 / 14.1.2.4 / 15.0.0. It is, therefore, affected by a vulnerability as referenced in the K63558580 advisory. - On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, whe...

F5 Networks BIG-IP : BIG-IP crypto driver vulnerability (K43815022)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.1 / 14.1.2.4 / 15.1.0. It is, therefore, affected by a vulnerability as referenced in the K43815022 advisory. Under certain conditions, the Intel QuickAssist Technology QAT cryptography driver may produce a Traffic...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K58494243)

Undisclosed HTTP/2 requests can lead to a denial of service when sent to a virtual server configured with the Fallback Host setting and a server-side HTTP/2 profile. CVE-2020-5891 Impact The Traffic Management Microkernel TMM may generate a core file and restart, causing a traffic disruption or...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K65372933)

Under certain conditions, the Traffic Management Microkernel TMM may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy. CVE-2020-5875 Impact If you have enabled HTTP/2, Message Routing Framework MRF, and SSL, a certain request sequence can trigger a condition...

PT-2020-18774 · F5 · F5 Big-Ip +1

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 11.6.1 through 11.6.5 F5 BIG-IP versions 12.1.0 through 12.1.5 F5 BIG-IP versions 13.1.0 through 13.1.3.1 F5 BIG-IP versions 14.1.0 through 14.1.2.3 F5 BIG-IP versions 15.0.0 through 15.0.1 F5 BIG-IQ versions 5.2.0 through...

F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K17663061)

BIG-IP systems set up for connection mirroring in a high availability HA pair transfersensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5885 Impact On-path attackers ma...

F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K65720640)

BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5886 Impact On-path attackers m...

F5 Networks BIG-IP : BIG-IP QKView vulnerability (K03318649)

When creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace. CVE-2020-5890 Impact The BIG-IP system may disclose sensitive information used for authentication with...

F5 Networks BIG-IP : BIG-IP iRules vulnerability (K54200228)

Malformed input to the DATAGRAM::tcp iRules command within a FLOWINIT event may lead to a denial of service. CVE-2020-5877 Impact Remote attackers may be able to perform a denial-of-service DoS attack on the BIG-IP system. C Tenable Network Security, Inc. The descriptive text and package checks i...

F5 Networks BIG-IP : BIG-IP VE interface vulnerability (K03386032)

When the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disruptingthe communication between the mcpd and tmm processesCVE-2020-5881. Impact This issue...

F5 Networks BIG-IP : BIG-IP APM virtual server vulnerability (K46901953)

In certain circumstances, an attacker sending specifically crafted requests to aBIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management MicrokernelTMM. CVE-2020-5874 Impact An attacker may be able to perform a denial-of-service DoS attack on a BIG-IP system ...

F5 Networks BIG-IP : BIG-IP restjavad vulnerability (K94325657)

The restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server. CVE-2020-5880 Impact A remote attacker may be able to fill the disk storage and make the...

F5 Networks BIG-IP : BIG-IP APM portal access reflected XSS vulnerability (K24415506)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.4 / 15.0.1.3 / 15.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K24415506 advisory. - On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a...

F5 BIG-IQ Information Disclosure Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. An information disclosure vulnerability exists in F5 BIG-IQ...

F5 BIG-IQ Access Control Error Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. An access control error vulnerability exists in F5 BIG-IQ...

CVE-2020-5870

In BIG-IQ 5.2.0-7.0.0, high availability HA synchronization mechanisms do not use any form of authentication for connecting to the peer...

F5 Networks BIG-IP : Lodash library vulnerability (K47105354)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.2 / 13.1.3.4 / 13.1.3.5 / 14.1.2.5 / 14.1.2.7 / 15.0.1.4 / 15.1.0.5 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K47105354 advisory. - Versions of lodash lower than 4.17.12 a...

F5 NGINX Controller Trust Management Issue Vulnerability

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions prior to 3.2.0, which stems from the fact that by...