PT-2020-18819 · F5 · F5 Big-Ip

Published 2020-08-26 · Updated 2021-07-21 · CVE-2020-5921

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 through 11.6.5.2 F5 BIG-IP versions 12.1.0 through 12.1.5.1 F5 BIG-IP versions 13.1.0 through 13.1.3.4 F5 BIG-IP versions 14.1.0 through 14.1.2.6 F5 BIG-IP versions 15.0.0 through 15.0.1.3 F5 BIG-IP versions 15.1.0 through 15.1.0.4

Description The issue is caused by a Syn flood, leading to a large number of MCPD context messages being sent to secondary blades, consuming memory, and resulting in MCPD failure. This issue specifically affects VIPRION hosts with two or more blades installed, while single-blade VIPRION hosts are not affected.

Recommendations For versions 11.6.1 through 11.6.5.2, update to a version outside of this range to resolve the issue. For versions 12.1.0 through 12.1.5.1, update to a version outside of this range to resolve the issue. For versions 13.1.0 through 13.1.3.4, update to a version outside of this range to resolve the issue. For versions 14.1.0 through 14.1.2.6, update to a version outside of this range to resolve the issue. For versions 15.0.0 through 15.0.1.3, update to a version outside of this range to resolve the issue. For versions 15.1.0 through 15.1.0.4, update to a version outside of this range to resolve the issue.

Fix

Related Identifiers

CVE-2020-5921

Affected Products

F5 Big-Ip

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-5921 · Security Note
• https://support.f5.com/csp/article/K00103216 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5921 · Vendor Advisory