F5 Big-ip Application Security Manager

On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured on a virtual server, undisclosed responses can cause Traffic Management Microkernel(TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAT Large Scale NAT (LSN) pool is configured on a virtual server and packet filtering is enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied.

BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651

TMM vulnerability CVE-2022-34655

HTTP2 profile vulnerability CVE-2022-35236

BIG-IP Message Routing MQTT vulnerability CVE-2022-35240

BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844

BIG-IP software SYN cookies vulnerability CVE-2022-36795

BIG-IP iRules vulnerability CVE-2022-41624

BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691

BIG-IP SIP vulnerability CVE-2022-41832

BIG-IP iRule vulnerability CVE-2022-41833

BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

BIG-IP SSL OCSP Authentication profile vulnerability

On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

BIG-IP SIP profile vulnerability

HTTP profile vulnerability

BIG-IP HTTP/2 profile vulnerability

BIG-IP SIP profile vulnerability

BIG-IP Virtual Edition vulnerability

BIG-IP UDP Profile vulnerability

BIG-IP IPsec vulnerability

BIG-IP HTTP/2 vulnerability

BIG-IP TCP Profile vulnerability

TMM Vulnerability

BIG-IP Websockets vulnerability

BIG-IP ASM and Advanced WAF vulnerability

BIG-IP HTTP/2 vulnerability

BIG-IP Advanced WAF and ASM vulnerability

BIG-IP TMM vulnerability

BIG-IP IPSEC vulnerability

F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability

TMM vulnerability CVE-2022-32455

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

BIG-IP HTTP MRF vulnerability CVE-2022-35272

BIG-IP TMUI XSS vulnerability

BIG-IP Configuration utility vulnerability

BIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerability