This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] F5 fixes 9 vulnerabilities in various products
F5 fixes 9 vulnerabilities in BIG-IP, BIG-IP Next Central Manager, BIG-IP Next SPK and BIG-IP Next CNF [1][2][3][4][5]. The most severe vulnerabilities are listed below. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.1, 16.1.5 [3][4][5] BIG-IP Next Central Manager - 20.2.1 [1][2] BIG-IP Next SPK - 1.9.0 [5] BIG-IP Next CNF - 1.2.0 [5]
An unauthenticated remote attacker can, under certain circumstances, impersonate another user in BIG-IP Next Central Manager by reusing an old session token [1].
The vulnerability is present in product:
- BIG-IP Next Central Manager; >=20.1, <20.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-39809 at cve.org, NVD
- CWE-613: Insufficient Session Expiration at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
An unauthenticated remote attacker can, under certain circumstances, block access to other users' accounts in BIG-IP Next Central Manager [2].
The vulnerability is present in product:
- BIG-IP Next Central Manager; >=20.1, <20.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-37028 at cve.org, NVD
- CWE-645: Overly Restrictive Account Lockout Mechanism at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
An unauthenticated remote attacker can carry out a DoS attack in BIG-IP. The vulnerability is exploitable only if a stateless virtual server together with HSB (High-Speed Bridge) is configured on the device [3].
The vulnerability is present in product:
- BIG-IP; >=15.1, <16.1.5; >=17.1, <17.1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-39778 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
An unauthenticated remote attacker can carry out a DoS attack in BIG-IP. The vulnerability is exploitable only if BIG-IP runs on r2000 or r4000 series hardware, or if the virtual version of BIG-IP uses an Intel E810 SR-IOV NIC [4].
The vulnerability is present in product:
- BIG-IP; >=15.1.0, <=15.1.10; >=16.1.0, <16.1.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-41727 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption. at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
An unauthenticated remote attacker can, under certain circumstances, carry out a DoS attack in BIG-IP and BIG-IP Next (SPK, CNF). The vulnerability is exploitable only if BIG-IP runs on a virtual server configured to use the Multipath TCP protocol [5].
The vulnerability is present in products:
- BIG-IP Next SPK; >=1.7, <1.9;
- BIG-IP Next CNF; >=1.1, <1.2;
- BIG-IP; >=15.1, <15.1.10; >=16.1, <16.1.5; >=17.1, <17.1.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-41164 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 22. 8. 2024.