Kwetsbaarheden verholpen in F5 BIG-IP

Summary

Details

Vulnerabilities 27

• Critical 9.8
  CVE-2024-56337

  Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CV…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Dec 20, 2024
• High 8.8
  CVE-2024-36242

  Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially ena…

  Nov 13, 2024
• High 8.8
  CVE-2025-20029 Public exploit

  BIG-IP iControl REST and tmsh vulnerability

  Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are n…

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 8.7
  CVE-2025-23239

  BIG-IP iControl REST vulnerability

  When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: …

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 8.0
  CVE-2025-24320

  BIG-IP Configuration utility vulnerability

  A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CV…

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-20045

  BIG-IP SIP MRF Vulnerability

  When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  …

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-20058

  BIG-IP message routing vulnerability

  When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-21087

  TMM Vulnerability

  When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Suppo…

  F5 BIG-IP BIG-IP Next Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-21091

  BIG-IP SNMP vulnerability

  When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-22846

  BIG-IP SIP Vulnerability

  When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS)…

  F5 BIG-IP BIG-IP Next SPK Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-22891

  BIG-IP PEM Vulnerability

  When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versi…

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-23412

  BIG-IP APM access profile vulnerability

  When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-24312

  BIG-IP AFM vulnerability

  When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU resource utilization.   Note: Software versions which have re…

  F5 BIG-IP BIG-IP Next CNF Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-24326

  BIG-IP Advanced WAF/ASM BADoS vulnerability

  When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  F5 BIG-IP Network devices
  Feb 5, 2025
• High 7.5
  CVE-2025-24497

  BIG-IP PEM vulnerability

  When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  F5 BIG-IP Network devices
  Feb 5, 2025
• Medium 6.5
  CVE-2025-24319

  BIG-IP Next Central Manager vulnerability

  When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support (EoT…

  F5 BIG-IP Next Central Manager Network devices
  Feb 5, 2025
• Medium 5.9
  CVE-2019-5010 Public exploit EPSS 21%

  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Oct 31, 2019
• Medium 5.3
  CVE-2019-16056

  An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Sep 6, 2019
• Medium 4.4
  CVE-2025-23413

  BIG-IP Next Central Manager vulnerability

  When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  F5 BIG-IP Next Central Manager Network devices
  Feb 5, 2025
• Medium 4.3
  CVE-2025-23419 Public exploit

  TLS Session Resumption Vulnerability

  When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://ngin…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 5, 2025
• Low 3.8
  CVE-2024-38660

  Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated …

  Nov 13, 2024
• Low 3.1
  CVE-2025-23415

  BIG-IP APM Endpoint Inspection vulnerability

  An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN clie…

  F5 BIG-IP Network devices
  Feb 5, 2025
• Unscored —
  CVE-2014-0064

  Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0…

  postgresql-9.3 postgresql-9.1 Ubuntu
  Mar 28, 2014
• Unscored —
  CVE-2014-0065

  Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, an…

  postgresql-9.3 postgresql-9.1 Ubuntu
  Mar 28, 2014
• Unscored —
  CVE-2014-0066

  The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.…

  postgresql-9.3 postgresql-9.1 Ubuntu
  Mar 28, 2014
• Unscored —
  CVE-2014-0067

  The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify…

  postgresql-9.3 postgresql-9.1 Ubuntu
  Mar 28, 2014
• Unscored —
  CVE-2022-26488 Public exploit

  In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. Th…

  Mar 7, 2022

Revision history

1. 2025-02-11 #1

   Door een technisch issue is deze advisory eerder verstuurd met een invalide signature, waardoor automatische verwerking mogelijk verstoord is. Deze update verhelpt dat. Er is verder geen inhoudelijke wijziging.

2. 2025-02-07 #0

   Initiele versie

References

• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000138757
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000138932
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000139656
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000139778
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000140578
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000140920
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000140933
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000140947
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000140950
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000141003
• Reference - cveprojectv5; nvd
  https://my.f5.com/manage/s/article/K000148587