PT-2019-18230 · F5+1 · As3+3

Published 2019-09-04 · Updated 2023-02-03 · CVE-2019-6648

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) version 1.9.0

Description The issue concerns the logging of sensitive information. When DEBUG logging is enabled on the affected version, log files may contain BIG-IP secrets, including SSL Private Keys and Private key Passphrases, which are provided as inputs by an AS3 Declaration.

Recommendations For version 1.9.0, consider disabling DEBUG logging to prevent the exposure of sensitive information in log files. As a temporary workaround, restrict access to log files to minimize the risk of secrets being accessed by unauthorized parties.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-6648

Affected Products

As3

Big-Ip

F5 Container Ingress Service

Red Hat Openshift

References · 5

• https://osv.dev/vulnerability/CVE-2019-6648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6648 · Security Note
• https://support.f5.com/csp/article/K74327432 · Vendor Advisory
• https://t.me/cvenotify/43569 · Telegram Post
• https://support.f5.com/csp/article/K74327432?utm_source=f5support&amp%3Butm_medium=RSS · Note