PT-2019-18220 · F5 · F5 Big-Ip

Published 2019-07-03 · Updated 2023-02-03 · CVE-2019-6638

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 through 14.1.0.5

Description The issue arises from malformed HTTP requests made to an undisclosed iControl REST endpoint, which can cause an infinite loop of the restjavad process.

Recommendations For F5 BIG-IP versions 14.0.0 through 14.0.0.4, update to a version that is not affected by this issue. For F5 BIG-IP versions 14.1.0 through 14.1.0.5, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the undisclosed iControl REST endpoint to minimize the risk of exploitation.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2019-6638

Affected Products

F5 Big-Ip

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-6638 · Security Note
• https://support.f5.com/csp/article/K67825238 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6638 · Vendor Advisory
• http://securityfocus.com/bid/109106 · Note
• https://t.me/cvenotify/245 · Telegram Post
• https://t.me/cvenotify/189 · Telegram Post
• https://support.f5.com/csp/article/K67825238?utm_source=f5support&amp%3Butm_medium=RSS · Note