Skip to content
OpenAdvisories
Medium WID-SEC-2024-1865 7 CVEs

F5 BIG-IP: Mehrere Schwachstellen

Published Aug 14, 2024 · Updated Aug 14, 2024 · de-DE

Vendor: F5 Product: BIG-IP

Summary

Ein Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.

Product

F5 FirePass ist ein SSL-VPN Gateway der F5 Corporation. Die BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen.

Vulnerabilities 7

  • High 7.5
    CVE-2024-39778

    BIG-IP HSB vulnerability

    When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2024-39809

    BIG-IP Next Central Manager vulnerability

    The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    F5 BIG-IP Next Central Manager Network devices
  • High 7.5
    CVE-2024-41727

    BIG-IP TMM vulnerability

    In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical …

    F5 BIG-IP Network devices
  • Medium 5.9
    CVE-2024-41164

    BIG-IP MPTCP vulnerability

    When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS…

    F5 BIG-IP BIG-IP Next CNF BIG-IP Next SPK Network devices
  • Medium 5.3
    CVE-2024-37028

    BIG-IP Next Central Manager vulnerability

    BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Next Central Manager Network devices
  • Medium 4.4
    CVE-2024-37891

    Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

    urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 4.2
    CVE-2024-41719

    BIG-IP Next Central Manager vulnerability

    When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Next Central Manager Network devices

Revision history

  1. #1

    Initiale Fassung

References