PT-2024-1922 · F5 · Big-Ip

Published 2024-02-14 · Updated 2024-02-14 · CVE-2024-23979

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIG-IP versions prior to the fixed version

Description The issue is related to an increase in CPU resource utilization when SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server. This can be caused by undisclosed requests. The vulnerability may allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2024-01710

CVE-2024-23979

Affected Products

Big-Ip

References · 8

• https://my.f5.com/manage/s/article/K000134516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23979 · Security Note
• https://bdu.fstec.ru/vul/2024-01710 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23979 · Vendor Advisory
• https://vuldb.com/ru/?id.253869 · Note
• https://twitter.com/VulmonFeeds/status/1757852475913130475 · Twitter Post
• https://twitter.com/cracbot/status/1758008320382886127 · Twitter Post
• https://twitter.com/CVEnew/status/1757806681260474553 · Twitter Post