PT-2019-18214 · F5 · F5 Big-Ip

Publicado 2019-07-03 · Atualizado 2021-07-21 · CVE-2019-6632

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.1.0 through 12.1.4 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 through 14.1.0.5

Description The issue allows attackers to decrypt configuration items that are encrypted due to the vCMP configuration unit key being generated with insufficient randomness. This can occur under certain circumstances, with the prerequisite being direct access to encrypted configuration and/or UCS files.

Recommendations For F5 BIG-IP versions 12.1.0 through 12.1.4, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation. For F5 BIG-IP versions 13.0.0 through 13.1.1.4, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation. For F5 BIG-IP versions 14.0.0 through 14.0.0.4, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation. For F5 BIG-IP versions 14.1.0 through 14.1.0.5, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2019-6632

Produtos afetados

F5 Big-Ip

Referências · 4

• https://support.f5.com/csp/article/K01413496 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6632 · Aviso do Fabricante
• http://securityfocus.com/bid/109112 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-6632 · Nota de Segurança