Description
BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| F5 | BIG-IP | 17.1.0 – < 17.1.1, 16.1.0 – < 16.1.4, 15.1.0 – < 15.1.9 | 17.1.1 |
| F5 | BIG-IQ | 8.0.0 | — |
Advisories 1
- WID-SEC-2024-0392 F5 BIG-IP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 14, 2024
References
- https://my.f5.com/manage/s/article/K98606833 vendor-advisory