When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| F5 | BIG-IP | 21.1.0 – < 21.1.0.1, 21.0.0 – < 21.0.0.3, 17.5.0 – < 17.5.1.8, 17.1.0 – < 17.1.3.4 | |
| f5 | big-ip next cloud-native network functions | 1.1.0 – < 1.4.3 | |
| F5 | BIG-IP Next CNF | 2.3.0 – < 2.3.2, 2.0.0 – < 2.2.3, 1.1.0 – < 1.4.3 | |
| F5 | BIG-IP Next for Kubernetes | 2.3.0 – < 2.3.2, 2.0.0 – < 2.2.3 | |
| f5 | big-ip next service proxy for kubernetes | 1.7.0 – < 1.7.18 | |
| F5 | BIG-IP Next SPK | 1.9.0, 1.7.0 – < 1.7.18 |
cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:* ≥ 1.1.0 < 1.4.3cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.2.3cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:2.3.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_next_for_kubernetes:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.2.3cpe:2.3:a:f5:big-ip_next_for_kubernetes:2.3.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:* ≥ 1.7.0 < 1.7.18cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:* ≥ 1.8.0 ≤ 1.9.2cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.3Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.