PT-2021-15337 · F5 · F5 Big-Ip

Published 2021-05-10 · Updated 2021-05-19 · CVE-2021-23010

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 16.0.x through 16.0.1.1 F5 BIG-IP versions 15.1.x through 15.1.2 F5 BIG-IP versions 14.1.x through 14.1.3.1 F5 BIG-IP versions 13.1.x through 13.1.3.5 F5 BIG-IP versions 12.1.x through 12.1.5.3

Description The issue occurs when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy. This can cause the BIG-IP ASM bd process to produce a core file.

Recommendations For versions 16.0.x, update to version 16.0.1.1 or later. For versions 15.1.x, update to version 15.1.2 or later. For versions 14.1.x, update to version 14.1.3.1 or later. For versions 13.1.x, update to version 13.1.3.5 or later. For versions 12.1.x, update to version 12.1.5.3 or later.

Fix

Related Identifiers

CVE-2021-23010

Affected Products

F5 Big-Ip

References · 3

• https://osv.dev/vulnerability/CVE-2021-23010 · Vendor Advisory
• https://support.f5.com/csp/article/K18570111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23010 · Security Note