PT-2022-19657 · F5 · Advanced Waf+3
Published
2022-05-05
·
Updated
2022-05-12
·
CVE-2022-29491
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
F5 BIG-IP LTM, Advanced WAF, ASM, or APM versions prior to 16.1.2.2
F5 BIG-IP LTM, Advanced WAF, ASM, or APM versions prior to 15.1.5
F5 BIG-IP LTM, Advanced WAF, ASM, or APM versions prior to 14.1.4.6
F5 BIG-IP LTM, Advanced WAF, ASM, or APM versions 13.1.x
F5 BIG-IP LTM, Advanced WAF, ASM, or APM versions 12.1.x
F5 BIG-IP LTM, Advanced WAF, ASM, or APM versions 11.6.x
Description
The issue occurs when a virtual server is configured with HTTP, TCP on one side and DTLS on the other, allowing undisclosed requests to cause the TMM process to terminate.
Recommendations
For versions prior to 16.1.2.2, update to version 16.1.2.2 or later.
For versions prior to 15.1.5, update to version 15.1.5 or later.
For versions prior to 14.1.4.6, update to version 14.1.4.6 or later.
For versions 13.1.x, 12.1.x, and 11.6.x, consider upgrading to a supported version, as these versions have reached End of Technical Support.
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apm
Asm
Advanced Waf
F5 Big-Ip Ltm