IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
9.8Kritik KEV

CVE-2021-22991F5 BIG-IP Traffic Management Microkernel Buffer Overflow

BIG-IP Yayım: (5 yıl önce)

Aktif olarak istismar ediliyor — F5 BIG-IP Traffic Management Microkernel Buffer Overflow

CISA bu açığın gerçek saldırılarda kullanıldığını 18.01.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 01.02.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-22991

Açıklama

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Zayıflık türü (CWE): CWE-119

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
f5 big-ip access policy manager 12.1.0 – < 12.1.5.3
f5 big-ip advanced firewall manager 12.1.0 – < 12.1.5.3
f5 big-ip advanced web application firewall 12.1.0 – < 12.1.5.3
f5 big-ip analytics 12.1.0 – < 12.1.5.3
f5 big-ip application acceleration manager 12.1.0 – < 12.1.5.3
f5 big-ip application security manager 12.1.0 – < 12.1.5.3
f5 big-ip ddos hybrid defender 12.1.0 – < 12.1.5.3
f5 big-ip domain name system 12.1.0 – < 12.1.5.3
f5 big-ip fraud protection service 12.1.0 – < 12.1.5.3
f5 big-ip global traffic manager 12.1.0 – < 12.1.5.3
f5 big-ip link controller 12.1.0 – < 12.1.5.3
f5 big-ip local traffic manager 12.1.0 – < 12.1.5.3
f5 big-ip policy enforcement manager 12.1.0 – < 12.1.5.3
f5 ssl orchestrator 12.1.0 – < 12.1.5.3
— BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (60)
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1

Aynı üründe son açıklar — F5 BIG-IP

9.8Kritik
CVE-2026-94127 KEV

BIG-IP APM OAuth vulnerability

F5 BIG-IP

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

27%EPSS
3.1Düşük
CVE-2026-63020

BIG-IP Configuration utility vulnerability

F5 BIG-IP

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message …

8.8Yüksek
CVE-2026-66842

BIG-IP and BIG-IQ Configuration utility vulnerability

F5 BIG-IP; F5 BIG-IQ

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attack…

7.5Yüksek
CVE-2026-59762

BIG-IP HTTP/2 vulnerability

F5 BIG-IP; F5 BIG-IP Next for Kubernetes; F5 BIG-IP Next SPK; F5 BIG-IP Next CNF

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.   Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. …

7.5Yüksek
CVE-2026-40423

BIG-IP SIP profile vulnerability

F5 BIG-IP

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.8Orta
CVE-2026-24464

Appliance mode iControl REST vulnerability

F5 BIG-IP

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files.  Note: Software vers…