PT-2020-18834 · F5 · Big-Ip Ltm

Published 2020-10-29 · Updated 2020-11-09 · CVE-2020-5936

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP LTM versions 12.1.0 through 12.1.5.1 BIG-IP LTM versions 13.1.0 through 13.1.3.4 BIG-IP LTM versions 14.1.0 through 14.1.2.7 BIG-IP LTM versions 15.1.0 through 15.1.0.5

Description The issue arises when the Traffic Management Microkernel (TMM) process handles SSL traffic and client authentication is enabled on the client SSL profile, leading to excessive resource consumption.

Recommendations For BIG-IP LTM versions 12.1.0 through 12.1.5.1, update to a version outside of this range to resolve the issue. For BIG-IP LTM versions 13.1.0 through 13.1.3.4, update to a version outside of this range to resolve the issue. For BIG-IP LTM versions 14.1.0 through 14.1.2.7, update to a version outside of this range to resolve the issue. For BIG-IP LTM versions 15.1.0 through 15.1.0.5, update to a version outside of this range to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-5936

Affected Products

Big-Ip Ltm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-5936 · Security Note
• https://support.f5.com/csp/article/K44020030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5936 · Vendor Advisory