PT-2020-18787 · F5 · Big-Ip

Published 2020-04-30 · Updated 2021-07-21 · CVE-2020-5886

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 12.1.0 through 12.1.5.1 BIG-IP versions 13.1.0 through 13.1.3.3 BIG-IP versions 14.1.0 through 14.1.2.3 BIG-IP versions 15.0.0 through 15.1.0.1

Description The issue affects BIG-IP systems set up for connection mirroring in a High Availability (HA) pair, where sensitive cryptographic objects are transferred over an insecure communications channel. This is a control plane issue exposed only on the network used for connection mirroring.

Recommendations For versions 12.1.0 through 12.1.5.1, consider disabling connection mirroring until a secure update is available. For versions 13.1.0 through 13.1.3.3, restrict access to the control plane to minimize exposure. For versions 14.1.0 through 14.1.2.3, avoid using the insecure communications channel for transferring sensitive cryptographic objects. For versions 15.0.0 through 15.1.0.1, apply configuration changes to secure the connection mirroring setup.

Fix

Cleartext Transmission of Sensitive Information

Inadequate Encryption Strength

Weakness Enumeration

CWE-319

CWE-326

Related Identifiers

CVE-2020-5886

Affected Products

Big-Ip

References · 4

• https://support.f5.com/csp/article/K65720640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5886 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5886 · Vendor Advisory
• https://t.me/cvenotify/3473 · Telegram Post