5.9

CVE-2020-5929

EPSS 1.09%
Veröffentlicht 25.09.2020 14:15:13
Zuletzt bearbeitet 21.11.2024 05:34:50
Erkennungen
Login

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 112 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

F5 ≫ Big-ip Access Policy Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Access Policy Manager Version 11.6.2 Update -

F5 ≫ Big-ip Access Policy Manager Version 12.1.2 Update -

F5 ≫ Big-ip Access Policy Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Access Policy Manager Version 13.0.0 Update -

F5 ≫ Big-ip Access Policy Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Access Policy Manager Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Advanced Firewall Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Advanced Firewall Manager Version 11.6.2 Update -

F5 ≫ Big-ip Advanced Firewall Manager Version 12.1.2 Update -

F5 ≫ Big-ip Advanced Firewall Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Advanced Firewall Manager Version 13.0.0 Update -

F5 ≫ Big-ip Advanced Firewall Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Advanced Firewall Manager Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Advanced Web Application Firewall Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Advanced Web Application Firewall Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Advanced Web Application Firewall Version 11.6.2 Update -

F5 ≫ Big-ip Advanced Web Application Firewall Version 12.1.2 Update -

F5 ≫ Big-ip Advanced Web Application Firewall Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Advanced Web Application Firewall Version 13.0.0 Update -

F5 ≫ Big-ip Advanced Web Application Firewall Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Advanced Web Application Firewall Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Analytics Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Analytics Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Analytics Version 11.6.2 Update -

F5 ≫ Big-ip Analytics Version 12.1.2 Update -

F5 ≫ Big-ip Analytics Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Analytics Version 13.0.0 Update -

F5 ≫ Big-ip Analytics Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Analytics Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Application Acceleration Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Application Acceleration Manager Version 11.6.2 Update -

F5 ≫ Big-ip Application Acceleration Manager Version 12.1.2 Update -

F5 ≫ Big-ip Application Acceleration Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Application Acceleration Manager Version 13.0.0 Update -

F5 ≫ Big-ip Application Acceleration Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Application Acceleration Manager Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Application Security Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Application Security Manager Version 11.6.2 Update -

F5 ≫ Big-ip Application Security Manager Version 12.1.2 Update -

F5 ≫ Big-ip Application Security Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Application Security Manager Version 13.0.0 Update -

F5 ≫ Big-ip Application Security Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Application Security Manager Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Ddos Hybrid Defender Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Ddos Hybrid Defender Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Ddos Hybrid Defender Version 11.6.2 Update -

F5 ≫ Big-ip Ddos Hybrid Defender Version 12.1.2 Update -

F5 ≫ Big-ip Ddos Hybrid Defender Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Ddos Hybrid Defender Version 13.0.0 Update -

F5 ≫ Big-ip Ddos Hybrid Defender Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Ddos Hybrid Defender Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Domain Name System Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Domain Name System Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Domain Name System Version 11.6.2 Update -

F5 ≫ Big-ip Domain Name System Version 12.1.2 Update -

F5 ≫ Big-ip Domain Name System Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Domain Name System Version 13.0.0 Update -

F5 ≫ Big-ip Domain Name System Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Domain Name System Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Fraud Protection Service Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Fraud Protection Service Version 11.6.2 Update -

F5 ≫ Big-ip Fraud Protection Service Version 12.1.2 Update -

F5 ≫ Big-ip Fraud Protection Service Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Fraud Protection Service Version 13.0.0 Update -

F5 ≫ Big-ip Fraud Protection Service Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Fraud Protection Service Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Global Traffic Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Global Traffic Manager Version 11.6.2 Update -

F5 ≫ Big-ip Global Traffic Manager Version 12.1.2 Update -

F5 ≫ Big-ip Global Traffic Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Global Traffic Manager Version 13.0.0 Update -

F5 ≫ Big-ip Global Traffic Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Global Traffic Manager Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Link Controller Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Link Controller Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Link Controller Version 11.6.2 Update -

F5 ≫ Big-ip Link Controller Version 12.1.2 Update -

F5 ≫ Big-ip Link Controller Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Link Controller Version 13.0.0 Update -

F5 ≫ Big-ip Link Controller Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Link Controller Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Local Traffic Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Local Traffic Manager Version 11.6.2 Update -

F5 ≫ Big-ip Local Traffic Manager Version 12.1.2 Update -

F5 ≫ Big-ip Local Traffic Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Local Traffic Manager Version 13.0.0 Update -

F5 ≫ Big-ip Local Traffic Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Local Traffic Manager Version 13.0.0 Update hotfix2

F5 ≫ Big-ip Policy Enforcement Manager Version >= 11.6.1 < 11.6.2

F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 < 12.1.2

F5 ≫ Big-ip Policy Enforcement Manager Version 11.6.2 Update -

F5 ≫ Big-ip Policy Enforcement Manager Version 12.1.2 Update -

F5 ≫ Big-ip Policy Enforcement Manager Version 12.1.2 Update hotfix1

F5 ≫ Big-ip Policy Enforcement Manager Version 13.0.0 Update -

F5 ≫ Big-ip Policy Enforcement Manager Version 13.0.0 Update hotfix1

F5 ≫ Big-ip Policy Enforcement Manager Version 13.0.0 Update hotfix2

F5 ≫ Ssl Orchestrator Version >= 11.6.1 < 11.6.2

F5 ≫ Ssl Orchestrator Version >= 12.1.0 < 12.1.2

F5 ≫ Ssl Orchestrator Version 11.6.2 Update -

F5 ≫ Ssl Orchestrator Version 12.1.2 Update -

F5 ≫ Ssl Orchestrator Version 12.1.2 Update hotfix1

F5 ≫ Ssl Orchestrator Version 13.0.0 Update -

F5 ≫ Ssl Orchestrator Version 13.0.0 Update hotfix1

F5 ≫ Ssl Orchestrator Version 13.0.0 Update hotfix2

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.09%	0.622

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.9	2.2	3.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST	2.6	4.9	2.9	AV:N/AC:H/Au:N/C:P/I:N/A:N

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

https://support.f5.com/csp/article/K91158923

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-5929

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-5929

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-5929

EUVD