PT-2022-26199 · Intel+1 · Intel Qat+1

Published 2022-10-19 · Updated 2022-10-24 · CVE-2022-41983

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.x F5 BIG-IP versions 14.1.x through 14.1.5.0 F5 BIG-IP versions 15.1.x through 15.1.6 F5 BIG-IP versions 16.1.x through 16.1.3.0

Description On specific hardware platforms, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher are in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.

Recommendations For versions 13.1.x, update to a version outside of this range to resolve the issue. For versions 14.1.x through 14.1.5.0, update to version 14.1.5.1 or later. For versions 15.1.x through 15.1.6, update to version 15.1.7 or later. For versions 16.1.x through 16.1.3.0, update to version 16.1.3.1 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2022-41983

Affected Products

F5 Big-Ip

Intel Qat

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-41983 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41983 · Vendor Advisory
• https://support.f5.com/csp/article/K31523465 · Vendor Advisory
• https://t.me/cibsecurity/51851 · Telegram Post