K05123525: ConfigSync vulnerability CVE-2019-6649

Security Advisory Description F5 BIG-IP and Enterprise Manager may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings. CVE-2019-6649 Impact The vulnerability is only present when the system is configured for high availability ...

K25033460: TMM vulnerability CVE-2017-6133

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service. CVE-2017-6133 Impact The Traffic Management Microkernel TMM generates a core...

K43815022: BIG-IP crypto driver vulnerability CVE-2020-5882

Security Advisory Description Under certain conditions, the Intel QuickAssist Technology QAT cryptography driver may produce a Traffic Management Microkernel TMM core file. CVE-2020-5882 Impact The BIG-IP system temporarily fails to process traffic as it recovers from TMM restarting, and systems...

K19361245: BIG-IP TMM vulnerability CVE-2017-6158

Security Advisory Description The Traffic Management Microkernel TMM has a vulnerability related to the handling of invalid IP addresses. CVE-2017-6158 This issue is exposed only when all of the following conditions are met: You have disabled the Auto Last Hop setting at the Virtual Server, VLAN,...

K51754851: BIG-IP system vulnerability CVE-2018-5512

Security Advisory Description When Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart. CVE-2018-5512 Impact An attacker may be able to cause a disruption of service. Exposure to this vulnerability is limited to the data...

K65720640: BIG-IP SSL state mirroring vulnerability CVE-2020-5886

Security Advisory Description BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring...

K21971977: TMM vulnerability CVE-2021-22975

Security Advisory Description Under some circumstances, Traffic Management Microkernel TMM may restart on the BIG-IP system while passing large bursts of traffic. CVE-2021-22975 Impact This vulnerability may allow an attacker to cause a denial-of-service DoS to the BIG-IP system. The BIG-IP syste...

K25595031: zxfrd vulnerability CVE-2020-27725

Security Advisory Description zxfrd leaks memory when listing DNS zones. Zones can be listed via TMSH, iControl or SNMP; only users with access to those services can trigger this vulnerability. CVE-2020-27725 Impact The memory leak by the zxfrd process eventually causes the system to experience a...

K45320419: TMM with HTTP/2 vulnerability CVE-2018-5514

Security Advisory Description Maliciously crafted HTTP/2 request frames can lead to denial of service. There is data plane exposure for virtual servers when the HTTP2 profile is enabled. There is no control plane exposure to this issue. CVE-2018-5514 Impact The BIG-IP system may temporarily fail ...

K19501795: BIG-IP HTTP profile vulnerability CVE-2019-6631

Security Advisory Description iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs. CVE-2019-6631 Impact The...

K12044607: TMM vulnerability CVE-2017-6132

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners...

K00103216: BIG-IP VIPRION MCPD vulnerability CVE-2020-5921

Security Advisory Description SYN flood causes a large number of MCPD context messages destined to secondary blades consuming memory and leading to MCPD failure. CVE-2020-5921 Impact This issue affects only VIPRION hosts with two or more blades installed, including those with Virtual Clustered...

K04518313: BIG-IP APM network access VPN vulnerability CVE-2020-27724

Security Advisory Description In BIG-IP APM, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic over the tunnel. CVE-2020-27724 Impact This vulnerability may cause the Traffic Management Microkernel...

K57214921: BIG-IP TMUI XSS vulnerability CVE-2020-5915

Security Advisory Description An undisclosed Traffic Management User Interface TMUI, or Configuration utility, page contains a vulnerability which allows a stored cross-site scripting XSS attack when BIG-IP systems are setup in a device trust. Impact On a BIG-IP system in a high availability HA...

K34074377: BIG-IQ HA vulnerability CVE-2021-22997

Security Advisory Description BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. CVE-2021-22997 Impact BIG-IQ The vulnerability could result in a confidential...

SUSE-SU-2023:0465-1 Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issues: Updated to version 1.3.1: - CVE-2022-46146: Fixed authentication bypass via cache poisoning in prometheus/exporter-toolkit bsc1208046, bsc1208047...

SUSE CVE-2016-5360

HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service uninitialized memory access and crash or possibly have unspecified other impact via unknown vectors...

SUSE CVE-2022-41881

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except...

CVE-2022-45028

A cross-site scripting XSS vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha...

RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.3] (RHSA-2022:8502)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8502 advisory. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to...