7.5

CVE-2023-40534

BIG-IP HTTP/2 vulnerability

When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Access Policy Manager Version 17.1.0
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Analytics Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Analytics Version 17.1.0
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Application Visibility And Reporting Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Carrier-grade Nat Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Carrier-grade Nat Version 17.1.0
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Ddos Hybrid Defender Version 17.1.0
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Domain Name System Version 17.1.0
F5 ≫ Big-ip Edge Gateway Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Edge Gateway Version 17.1.0
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Fraud Protection Service Version 17.1.0
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Global Traffic Manager Version 17.1.0
F5 ≫ Big-ip Link Controller Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Link Controller Version 17.1.0
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Local Traffic Manager Version 17.1.0
F5 ≫ Big-ip Next Service Proxy For Kubernetes Version >= 1.6.0 <= 1.8.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Ssl Orchestrator Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Ssl Orchestrator Version 17.1.0
F5 ≫ Big-ip Webaccelerator Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Webaccelerator Version 17.1.0
F5 ≫ Big-ip Websafe Version >= 16.1.0 < 16.1.4.1
F5 ≫ Big-ip Websafe Version 17.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.409
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
F5 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

https://my.f5.com/manage/s/article/K000133467
Vendor Advisory