PT-2023-6400 · F5 · Big-Ip

Published 2023-10-10 · Updated 2023-10-19 · CVE-2023-40534

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIG-IP versions prior to the fixed version

Description The issue is related to errors in memory release, which can be exploited by a remote attacker to cause a denial of service. When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2023-07114

CVE-2023-40534

Affected Products

Big-Ip

References · 6

• https://bdu.fstec.ru/vul/2023-07114 · Security Note
• https://my.f5.com/manage/s/article/K000133467 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40534 · Security Note
• https://t.me/cibsecurity/71924 · Telegram Post
• https://vuldb.com/ru/?id.241672 · Note