CVE-2019-6650

F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings...

F5 Networks BIG-IP : BIG-IP ASM vulnerability (K04280042)

F5 BIG-IP ASM may expose sensitive information and allow the system configuration to be modified when using non-default settings. CVE-2019-6650 Impact The vulnerability is only present on multi-bladed systems VIPRION with BIG-IP ASM provisioned, on the following interfaces : Management interface ...

F5 Networks BIG-IP : ConfigSync vulnerability (K05123525)

F5 BIG-IP and Enterprise Manager may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.CVE-2019-6649 Impact The vulnerability is only present when the system is configured for high availability HAand either of the following...

CVE-2019-6648

On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service CIS for Kubernetes and Red Hat OpenShift k8s-bigip-ctlr log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration...

Design/Logic Flaw

On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service CIS for Kubernetes and Red Hat OpenShift k8s-bigip-ctlr log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration...

CVE-2019-6648

On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service CIS for Kubernetes and Red Hat OpenShift k8s-bigip-ctlr log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration...

CVE-2019-6648

CVE-2019-6648 affects F5 Container Ingress Services for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) version 1.9.0. When DEBUG logging is enabled, CIS log files may disclose BIG-IP secrets (SSL private keys and private key passphrases) supplied via an AS3 Declaration. Impact is exposure of s...

F5 Networks BIG-IP : Linux kernel vulnerability (K93472064)

The biomapuseriov and biounmapuser functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bioaddpcpage function merges them into one, but the page reference is never dropped. This...

F5 Networks BIG-IP : BIND vulnerability (K10092301)

A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 - 9.11.7, 9.12.0 - 9.12.4-P1, 9.14.0 - 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of...

F5 Networks BIG-IP : iRulesLX debug NodeJS vulnerability (K75532331)

Similar to the issue identified inCVE-2018-12120, the BIG-IP system will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible.CVE-2019-6644 Impact A remote attacker may be able ...

F5 Networks BIG-IP : Linux kernel vulnerability (K42142782)

A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary. CVE-2017-15121 Impact An attacker can exploit this vulnerability to cause a denial of service DoS on the affected...

F5 Networks BIG-IP : BIG-IP mcpd vulnerability (K87920510)

When processing authentication attempts for control-plane users, mcpd leaks a small amount of memory. Under rare conditions, attackers with access to the management interface can eventually deplete memory on the system. CVE-2019-6647 Impact Repeated failed authentication attempts progressively...

F5 Networks BIG-IP : BIG-IP FTP profile vulnerability (K15759349)

FTP traffic passing through a virtual server with both an active FTP profile associated and connection mirroring configured may cause the Traffic Management Microkernel TMM to stop responding, causing the configured high availability HA action to be taken. CVE-2019-6645 Impact This vulnerability...

F5 Networks BIG-IP : F5 tmsh vulnerability (K40378764)

"Authenticated users with the ability to upload files via scp, for example can escalate their privileges to allow root shell access from within the TMOS Shell tmsh interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp . CVE-2019-6642 Impact...

F5 Networks BIG-IP : iControl REST vulnerability (K53990093)

REST users with guest privileges may beable to escalate their privilegesand run commands with admin privileges. CVE-2019-6646 Impact Users with guest privileges are able to exploit this vulnerability to escalate their access privileges. C Tenable Network Security, Inc. The descriptive text and...

Multiple F5 BIG-IP Products CVE-2019-6647 Memory Leak Denial of Service Vulnerability

Description Multiple F5 BIG-IP Products are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause excessive memory consumption; resulting in denial-of-service conditions. Technologies Affected F5 BIG-IP AAM 11.5.1 F5 BIG-IP AAM 11.6.4 F5 BIG-IP AAM 12.1.0 F5 BIG-...

F5 Networks BIG-IP : Linux kernel vulnerability (K24578092)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.2 / 15.0.0. It is, therefore, affected by a vulnerability as referenced in the K24578092 advisory. - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via ...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2019-30622)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in F5 BIG-IP AFM and PEM, which can be exploited by an attacker to execute...

F5 BIG-IP Information Disclosure Vulnerability (CNVD-2019-30623)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in SNMP in F5 BIG-IP, which can be exploited by an attacker to gain access to...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2019-30620)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in the AFM feed list in the F5 BIG-IP AFM and ASM, which can be exploited by an...