PT-2019-18191 · F5 · Big-Ip

Published 2019-04-15 · Updated 2020-08-24 · CVE-2019-6609

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP versions 12.1.1 HF2 through 12.1.4 BIG-IP versions 13.0.0 through 13.1.1.3 BIG-IP versions 14.0.0 through 14.1.0.1

Description This issue is a platform-dependent weakness that only impacts iSeries platforms. It affects the secure storage of the unit key, causing it to be stored in plaintext on disk instead of using the F5 hardware support. This also results in the unit key being stored in plaintext in UCS files taken on these platforms.

Recommendations For BIG-IP versions 12.1.1 HF2 through 12.1.4, update to a version that sets the secureKeyCapable attribute to utilize the F5 hardware support for secure unit key storage. For BIG-IP versions 13.0.0 through 13.1.1.3, update to a version that sets the secureKeyCapable attribute to utilize the F5 hardware support for secure unit key storage. For BIG-IP versions 14.0.0 through 14.1.0.1, update to a version that sets the secureKeyCapable attribute to utilize the F5 hardware support for secure unit key storage.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-6609

Affected Products

Big-Ip

References · 3

• https://support.f5.com/csp/article/K18535734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6609 · Security Note