PT-2020-18841 · F5 · Big-Ip

Published 2020-11-05 · Updated 2021-07-21 · CVE-2020-5943

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 14.1.0 through 14.1.0.1 BIG-IP versions 14.1.2.5 through 14.1.2.7

Description The issue arises when a BIG-IP object is created or listed through the REST interface. In the affected versions, protected fields are obfuscated in the REST response but not protected via a SecureVault cryptogram, unlike TMSH. An example of protected fields is the GTM monitor password.

Recommendations For versions 14.1.0 through 14.1.0.1, consider restricting access to the REST interface until a patch is available. For versions 14.1.2.5 through 14.1.2.7, consider disabling the creation or listing of BIG-IP objects through the REST interface as a temporary workaround.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2020-5943

Affected Products

Big-Ip

References · 4

• https://support.f5.com/csp/article/K20059815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5943 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5943 · Vendor Advisory
• https://t.me/cibsecurity/15898 · Telegram Post