Skip to content
OpenAdvisories
High · 7.5 CVE-2022-34651 EUVD-2022-37603GHSA-w85q-r4hm-228c

BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651

Published Aug 4, 2022 · Updated Sep 16, 2024 · Assigned by f5

Description

In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

VendorProductAffectedFixed
F5 BIG-IP 15.1.x – < 15.1.6.1, 16.1.x – < 16.1.3.1 15.1.6.1

References