PT-2021-15376 · F5 · Big-Ip

Published 2021-09-14 · Updated 2022-08-30 · CVE-2021-23053

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions BIG-IP versions 13.1.x through 13.1.3.6 BIG-IP versions 14.1.x through 14.1.3.1 BIG-IP versions 15.1.x through 15.1.3

Description When the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to lack of row limit on undisclosed tables in the MYSQL database.

Recommendations For versions 13.1.x through 13.1.3.6, update to version 13.1.3.6 or later to resolve the issue. For versions 14.1.x through 14.1.3.1, update to version 14.1.3.1 or later to resolve the issue. For versions 15.1.x through 15.1.3, update to version 15.1.3 or later to resolve the issue. As a temporary workaround, consider disabling the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM on the virtual server until a patch is available.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2021-23053

Affected Products

Big-Ip

References · 5

• https://support.f5.com/csp/article/K36942191 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23053 · Security Note
• https://t.me/cvenotify/35419 · Telegram Post
• https://t.me/cibsecurity/28800 · Telegram Post