PT-2024-19799 · F5 · Big-Ip

Published 2024-02-14 · Updated 2024-12-12 · CVE-2024-23308

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP (affected versions not specified)

Description When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. The condition results from setting the Request Body Handling option in the Header-Based Content Profile for an Allowed URL with "Apply value and content signatures and detect threat campaigns."

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-23308

Affected Products

Big-Ip

References · 7

• https://osv.dev/vulnerability/CVE-2024-23308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23308 · Security Note
• https://my.f5.com/manage/s/article/K000137416 · Vendor Advisory
• https://twitter.com/CVEnew/status/1757806674079891840 · Twitter Post
• https://twitter.com/cracbot/status/1758008315723047067 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757853994926395851 · Twitter Post
• https://twitter.com/dailycve/status/1867308985059029405 · Twitter Post