PT-2019-18238 · F5 · F5 Big-Ip Apm Edge Client+1

Publicado 2019-09-25 · Atualizado 2019-10-09 · CVE-2019-6656

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM Edge Client versions prior to 7.1.8 F5 BIG-IP APM versions 15.0.0 through 15.0.1 F5 BIG-IP APM versions 14.1.0 through 14.1.0.6 F5 BIG-IP APM versions 14.0.0 through 14.0.0.4 F5 BIG-IP APM versions 13.0.0 through 13.1.1.5 F5 BIG-IP APM versions 12.1.0 through 12.1.5 F5 BIG-IP APM versions 11.5.1 through 11.6.5

Description The issue concerns the logging of the full apm session ID in log files by the BIG-IP APM Edge Client. This could potentially lead to information disclosure.

Recommendations For F5 BIG-IP APM Edge Client versions prior to 7.1.8, update to version 7.1.8 or later. For F5 BIG-IP APM versions 15.0.0 through 15.0.1, 14.1.0 through 14.1.0.6, 14.0.0 through 14.0.0.4, 13.0.0 through 13.1.1.5, 12.1.0 through 12.1.5, and 11.5.1 through 11.6.5, update the APM Clients component to version 7.1.8 or later, as these components can be updated independently from BIG-IP software in version 13.1.0 and later.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2019-6656

Produtos afetados

F5 Big-Ip Apm

F5 Big-Ip Apm Edge Client

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-6656 · Nota de Segurança
• https://support.f5.com/csp/article/K23876153 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6656 · Aviso do Fabricante
• https://support.f5.com/csp/article/K23876153?utm_source=f5support&amp%3Butm_medium=RSS · Nota