7.5

CVE-2023-40534

BIG-IP HTTP/2 vulnerability

When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Access Policy Manager Version17.1.0
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Analytics Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Analytics Version17.1.0
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Application Visibility And Reporting Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Carrier-grade Nat Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Carrier-grade Nat Version17.1.0
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Ddos Hybrid Defender Version17.1.0
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Domain Name System Version17.1.0
F5 ≫ Big-ip Edge Gateway Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Edge Gateway Version17.1.0
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Global Traffic Manager Version17.1.0
F5 ≫ Big-ip Link Controller Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Link Controller Version17.1.0
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Local Traffic Manager Version17.1.0
F5 ≫ Big-ip Next Service Proxy For Kubernetes Version >= 1.6.0 <= 1.8.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Ssl Orchestrator Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Ssl Orchestrator Version17.1.0
F5 ≫ Big-ip Webaccelerator Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Webaccelerator Version17.1.0
F5 ≫ Big-ip Websafe Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Websafe Version17.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.409
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
f5sirt@f5.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

https://my.f5.com/manage/s/article/K000133467
Vendor Advisory