CVE-2020-5929
Description
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.
How to fix
- f5 big-ip_access_policy_manager11.6.2, 12.1.2 or later
- f5 big-ip_advanced_firewall_manager11.6.2, 12.1.2 or later
- f5 big-ip_advanced_web_application_firewall11.6.2, 12.1.2 or later
- f5 big-ip_analytics11.6.2, 12.1.2 or later
- f5 big-ip_application_acceleration_manager11.6.2, 12.1.2 or later
- f5 big-ip_application_security_manager11.6.2, 12.1.2 or later
- f5 big-ip_ddos_hybrid_defender11.6.2, 12.1.2 or later
- f5 big-ip_domain_name_system11.6.2, 12.1.2 or later
- f5 big-ip_fraud_protection_service11.6.2, 12.1.2 or later
- f5 big-ip_global_traffic_manager11.6.2, 12.1.2 or later
- f5 big-ip_link_controller11.6.2, 12.1.2 or later
- f5 big-ip_local_traffic_manager11.6.2, 12.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip_access_policy_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_advanced_firewall_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_advanced_web_application_firewall | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_analytics | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_application_acceleration_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_application_security_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_ddos_hybrid_defender | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_domain_name_system | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_fraud_protection_service | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_global_traffic_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_link_controller | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_local_traffic_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 big-ip_policy_enforcement_manager | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
| f5 ssl_orchestrator | 11.6.1 ≤ v < 11.6.2, 12.1.0 ≤ v < 12.1.2, 11.6.2, 12.1.2, 13.0.0 | 11.6.2, 12.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.