PT-2019-18214 · F5 · F5 Big-Ip

Published 2019-07-03 · Updated 2021-07-21 · CVE-2019-6632

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.1.0 through 12.1.4 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 through 14.1.0.5

Description The issue allows attackers to decrypt configuration items that are encrypted due to the vCMP configuration unit key being generated with insufficient randomness. This can occur under certain circumstances, with the prerequisite being direct access to encrypted configuration and/or UCS files.

Recommendations For F5 BIG-IP versions 12.1.0 through 12.1.4, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation. For F5 BIG-IP versions 13.0.0 through 13.1.1.4, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation. For F5 BIG-IP versions 14.0.0 through 14.0.0.4, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation. For F5 BIG-IP versions 14.1.0 through 14.1.0.5, update to a version that addresses the issue of insufficient randomness in the vCMP configuration unit key generation.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2019-6632

Affected Products

F5 Big-Ip

References · 4

• https://support.f5.com/csp/article/K01413496 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6632 · Security Note
• http://securityfocus.com/bid/109112 · Note