6.5

CVE-2020-5938

On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Advanced Firewall Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Analytics Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Analytics Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Application Acceleration Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Application Security Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Domain Name System Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Domain Name System Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Domain Name System Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Fraud Protection Service Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Global Traffic Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Global Traffic Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Link Controller Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Link Controller Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Local Traffic Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Big-ip Policy Enforcement Manager Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 13.1.3.4
F5 ≫ Ssl Orchestrator Version >= 11.6.1 <= 11.6.5.2
F5 ≫ Ssl Orchestrator Version >= 12.1.0 <= 12.1.5.2
F5 ≫ Ssl Orchestrator Version >= 13.1.0 <= 13.1.3.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.52% 0.401
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

https://support.f5.com/csp/article/K76610106
Vendor Advisory