5.5

CVE-2019-6632

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.

Data is provided by the National Vulnerability Database (NVD)
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Local Traffic Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Local Traffic Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Analytics Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Analytics Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Analytics Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Analytics Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Access Policy Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Access Policy Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Application Security Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Application Security Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Application Security Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Domain Name System Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Domain Name System Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Domain Name System Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Domain Name System Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Edge Gateway Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Edge Gateway Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Edge Gateway Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Edge Gateway Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Global Traffic Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Global Traffic Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Global Traffic Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Link Controller Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Link Controller Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Link Controller Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Link Controller Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Webaccelerator Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Webaccelerator Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Webaccelerator Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Webaccelerator Version >= 14.1.0 < 14.1.0.6
F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 < 12.1.4.1
F5 ≫ Big-ip Fraud Protection Service Version >= 13.0.0 < 13.1.1.5
F5 ≫ Big-ip Fraud Protection Service Version >= 14.0.0 < 14.0.0.5
F5 ≫ Big-ip Fraud Protection Service Version >= 14.1.0 < 14.1.0.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.11% 0.269
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

http://www.securityfocus.com/bid/109112
Third Party Advisory
VDB Entry