PT-2021-15314 · F5 · Big-Ip

Published 2021-02-12 · Updated 2021-02-19 · CVE-2021-22981

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x through 12.1.x

Description The original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation.

Recommendations For BIG-IP versions 11.6.x through 12.1.x, consider enabling the Extended Master Secret (EMS) extension to mitigate the risk of man-in-the-middle attacks during renegotiation. As a temporary workaround, restrict TLS connections to only use EMS until a more permanent solution is available.

Fix

Related Identifiers

CVE-2021-22981

Affected Products

Big-Ip

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-22981 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22981 · Vendor Advisory
• https://support.f5.com/csp/article/K09121542 · Vendor Advisory
• https://t.me/cibsecurity/23556 · Telegram Post