Refine your search

13 vulnerabilities found for BIG-IQ by F5

CERTFR-2023-AVI-0837
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 NGINX NGINX OSS versions 1.9.5 à 1.25.2
F5 BIG-IP BIG-IP (tous modules) versions 16.1.x antérieures à 16.1.4.1 avec le correctif de sécurité Hotfix-BIGIP-16.1.4.1.0.13.5-ENG
F5 BIG-IQ BIG-IQ Centralized Management versions 8.0.0 à 8.3.0 antérieures à 8.3.0 avec le correctif Hotfix-BIG-IQ-8.3.0.0.12.118-ENG
F5 BIG-IP Next BIG-IP Next SPK versions 1.5.0 à 1.8.2
F5 BIG-IP BIG-IP (APM) versions 16.1.0 à 16.1.3 antérieures à 16.1.4
F5 NGINX Ingress Controller NGINX Ingress Controller versions 3.0.0 à 3.3.0
F5 BIG-IP BIG-IP (Advanced WAF/ASM) versions 16.1.x antérieures à 16.1.4
F5 NGINX Plus NGINX Plus verions R25 à R30 antérieures à R30 P1
F5 BIG-IP BIG-IP (DNS, LTM avec le license DNS Services activée) versions 13.1.x, 14.1.x, 15.1.x antérieures à 15.1.9
F5 NGINX Ingress Controller NGINX Ingress Controller versions 2.0.0 à 2.4.2
F5 BIG-IP BIG-IP (DNS, LTM avec le license DNS Services activée) versions 16.1.x antérieures à 16.1.4
F5 NGINX Ingress Controller NGINX Ingress Controller versions 1.12.2 à 1.12.5
F5 BIG-IP Next BIG-IP Next CNF versions 1.1.0 à 1.1.1
F5 NGINX NGINX App Protect WAF versions 3.3.0 à 3.12.2 et 4.x antérieures à 4.2.0
F5 BIG-IP BIG-IP (Advanced WAF/ASM) versions 13.1.x, 14.1.x, 15.1.x antérieures à 15.1.9
F5 N/A APM Clients versions 7.2.3.x, 7.2.4.x antérieures à 7.2.4.5
F5 BIG-IP Next BIG-IP Next (tous modules) version 20.0.1
F5 BIG-IP BIG-IP (tous modules) versions 13.1.x, 14.1.x, 15.1.x antérieures à 15.1.10.2
F5 BIG-IP BIG-IP (tous modules) versions 17.1.x antérieures à 17.1.0.3 avec le correctif de sécurité Hotfix-BIGIP-17.1.0.3.0.23.4-ENG
F5 BIG-IP BIG-IP (APM) versions 14.1.x, 15.1.x antérieures à 15.1.9
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NGINX OSS versions 1.9.5 \u00e0 1.25.2",
      "product": {
        "name": "NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (tous modules) versions 16.1.x ant\u00e9rieures \u00e0 16.1.4.1 avec le correctif de s\u00e9curit\u00e9 Hotfix-BIGIP-16.1.4.1.0.13.5-ENG",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management versions 8.0.0 \u00e0 8.3.0 ant\u00e9rieures \u00e0 8.3.0 avec le correctif Hotfix-BIG-IQ-8.3.0.0.12.118-ENG",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Next SPK versions 1.5.0 \u00e0 1.8.2",
      "product": {
        "name": "BIG-IP Next",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (APM) versions 16.1.0 \u00e0 16.1.3 ant\u00e9rieures \u00e0 16.1.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 3.0.0 \u00e0 3.3.0",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (Advanced WAF/ASM) versions 16.1.x ant\u00e9rieures \u00e0 16.1.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus verions R25 \u00e0 R30 ant\u00e9rieures \u00e0 R30 P1",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (DNS, LTM avec le license DNS Services activ\u00e9e) versions 13.1.x, 14.1.x, 15.1.x ant\u00e9rieures \u00e0 15.1.9",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 2.0.0 \u00e0 2.4.2",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (DNS, LTM avec le license DNS Services activ\u00e9e) versions 16.1.x ant\u00e9rieures \u00e0 16.1.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 1.12.2 \u00e0 1.12.5",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Next CNF versions 1.1.0 \u00e0 1.1.1",
      "product": {
        "name": "BIG-IP Next",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX App Protect WAF versions 3.3.0 \u00e0 3.12.2 et 4.x ant\u00e9rieures \u00e0 4.2.0",
      "product": {
        "name": "NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (Advanced WAF/ASM) versions 13.1.x, 14.1.x, 15.1.x ant\u00e9rieures \u00e0 15.1.9",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "APM Clients versions 7.2.3.x, 7.2.4.x ant\u00e9rieures \u00e0 7.2.4.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Next (tous modules) version 20.0.1",
      "product": {
        "name": "BIG-IP Next",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (tous modules) versions 13.1.x, 14.1.x, 15.1.x ant\u00e9rieures \u00e0 15.1.10.2",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (tous modules) versions 17.1.x ant\u00e9rieures \u00e0 17.1.0.3 avec le correctif de s\u00e9curit\u00e9 Hotfix-BIGIP-17.1.0.3.0.23.4-ENG",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (APM) versions 14.1.x, 15.1.x ant\u00e9rieures \u00e0 15.1.9",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-40542",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40542"
    },
    {
      "name": "CVE-2023-5450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5450"
    },
    {
      "name": "CVE-2023-41373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41373"
    },
    {
      "name": "CVE-2023-43746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-43746"
    },
    {
      "name": "CVE-2023-40537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40537"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-41085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41085"
    },
    {
      "name": "CVE-2023-41253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41253"
    },
    {
      "name": "CVE-2023-42768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42768"
    },
    {
      "name": "CVE-2023-43611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-43611"
    },
    {
      "name": "CVE-2023-45226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45226"
    },
    {
      "name": "CVE-2023-45219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45219"
    },
    {
      "name": "CVE-2023-41964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41964"
    },
    {
      "name": "CVE-2023-39447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39447"
    },
    {
      "name": "CVE-2023-40534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40534"
    },
    {
      "name": "CVE-2023-43485",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-43485"
    }
  ],
  "initial_release_date": "2023-10-12T00:00:00",
  "last_revision_date": "2023-10-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0837",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-10-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000137053 du 10 octobre 2023",
      "url": "https://my.f5.com/manage/s/article/K000137053"
    }
  ]
}

CERTFR-2022-AVI-704
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IP BIG-IP (tous modules) versions 16.x antérieures à 16.1.3.1
F5 BIG-IP BIG-IP (tous modules) versions 17.x antérieures à 17.0.0.1
F5 BIG-IP BIG-IP (tous modules) versions 15.x antérieures à 15.1.6.1
F5 NGINX Instance Manager NGINX Instance Manager versions 2.x antérieures à 2.3.1
F5 BIG-IQ BIG-IQ Centralized Management versions 8.x antérieures à 8.2.0
F5 NGINX Ingress Controller NGINX Ingress Controller versions 2.x antérieures à 2.3.0
F5 BIG-IP BIG-IP (tous modules) versions 14.x antérieures à 14.1.5.1
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IP (tous modules) versions 16.x ant\u00e9rieures \u00e0 16.1.3.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (tous modules) versions 17.x ant\u00e9rieures \u00e0 17.0.0.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (tous modules) versions 15.x ant\u00e9rieures \u00e0 15.1.6.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Instance Manager versions 2.x ant\u00e9rieures \u00e0 2.3.1",
      "product": {
        "name": "NGINX Instance Manager",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management versions 8.x ant\u00e9rieures \u00e0 8.2.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 2.x ant\u00e9rieures \u00e0 2.3.0",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (tous modules) versions 14.x ant\u00e9rieures \u00e0 14.1.5.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-31473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31473"
    },
    {
      "name": "CVE-2022-35240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35240"
    },
    {
      "name": "CVE-2022-33203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33203"
    },
    {
      "name": "CVE-2022-30535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30535"
    },
    {
      "name": "CVE-2022-35241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35241"
    },
    {
      "name": "CVE-2022-35243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35243"
    },
    {
      "name": "CVE-2022-34865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34865"
    },
    {
      "name": "CVE-2022-35236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35236"
    },
    {
      "name": "CVE-2022-34862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34862"
    },
    {
      "name": "CVE-2022-35728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35728"
    },
    {
      "name": "CVE-2022-34651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34651"
    },
    {
      "name": "CVE-2022-35272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35272"
    },
    {
      "name": "CVE-2022-34655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34655"
    },
    {
      "name": "CVE-2022-32455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32455"
    },
    {
      "name": "CVE-2022-35245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35245"
    },
    {
      "name": "CVE-2022-33947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33947"
    },
    {
      "name": "CVE-2022-35735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35735"
    },
    {
      "name": "CVE-2022-34844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34844"
    },
    {
      "name": "CVE-2022-33968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33968"
    },
    {
      "name": "CVE-2022-34851",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34851"
    },
    {
      "name": "CVE-2022-33962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33962"
    }
  ],
  "initial_release_date": "2022-08-04T00:00:00",
  "last_revision_date": "2022-08-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-704",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-08-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K14649763 du 03 ao\u00fbt 2022",
      "url": "https://support.f5.com/csp/article/K14649763"
    }
  ]
}

CERTFR-2022-AVI-062
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans F5 BIG-IP et BIG-IQ. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IP BIG-IP tous les modules versions 16.x antérieures à 16.1.2.1
F5 BIG-IP BIG-IP tous les modules versions 14.x antérieures à 14.1.4.5
F5 BIG-IP BIG-IP tous les modules versions 15.x antérieures à 15.1.5
F5 BIG-IQ BIG-IQ Centralized Management versions 8.x antérieures à 8.1.0
F5 BIG-IQ BIG-IQ Centralized Management versions 7.x
References
Bulletin de sécurité F5 K17514331 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K61112120 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K30525503 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K28042514 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K47592780 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K96924184 du 19 février 2022 None vendor-advisory
Bulletin de sécurité F5 K11742742 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K26310765 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K68755210 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K08402414 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K41415626 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K30911244 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K54892865 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K82793463 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K91013510 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K53442005 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K30573026 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K93526903 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K41503304 du 19 février 2022 None vendor-advisory
Bulletin de sécurité F5 K16101409 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K34360320 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K29500533 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K57111075 du 19 février 2022 None vendor-advisory
Bulletin de sécurité F5 K50343028 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K44110411 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K24358905 du 19 janvier 2022 None vendor-advisory
Bulletin de sécurité F5 K08476614 du 19 janvier 2022 None vendor-advisory

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IP tous les modules versions 16.x ant\u00e9rieures \u00e0 16.1.2.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP tous les modules versions 14.x ant\u00e9rieures \u00e0 14.1.4.5",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP tous les modules versions 15.x ant\u00e9rieures \u00e0 15.1.5",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management versions 8.x ant\u00e9rieures \u00e0 8.1.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management versions 7.x",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-23009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23009"
    },
    {
      "name": "CVE-2022-23019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23019"
    },
    {
      "name": "CVE-2022-23018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23018"
    },
    {
      "name": "CVE-2022-23023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23023"
    },
    {
      "name": "CVE-2022-23017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23017"
    },
    {
      "name": "CVE-2022-23022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23022"
    },
    {
      "name": "CVE-2022-23016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23016"
    },
    {
      "name": "CVE-2022-23030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23030"
    },
    {
      "name": "CVE-2022-23032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23032"
    },
    {
      "name": "CVE-2022-23026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23026"
    },
    {
      "name": "CVE-2022-23028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23028"
    },
    {
      "name": "CVE-2022-23015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23015"
    },
    {
      "name": "CVE-2022-23020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23020"
    },
    {
      "name": "CVE-2022-23031",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23031"
    },
    {
      "name": "CVE-2022-23014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23014"
    },
    {
      "name": "CVE-2022-23010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23010"
    },
    {
      "name": "CVE-2022-23025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23025"
    },
    {
      "name": "CVE-2022-23011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23011"
    },
    {
      "name": "CVE-2022-23012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23012"
    },
    {
      "name": "CVE-2022-23029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23029"
    },
    {
      "name": "CVE-2022-23021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23021"
    },
    {
      "name": "CVE-2022-23027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23027"
    },
    {
      "name": "CVE-2022-23024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23024"
    },
    {
      "name": "CVE-2022-23013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23013"
    }
  ],
  "initial_release_date": "2022-01-20T00:00:00",
  "last_revision_date": "2022-01-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-062",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-01-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans F5 BIG-IP et\nBIG-IQ. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans F5 BIG-IP et BIG-IQ",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K17514331 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K17514331"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K61112120 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K61112120"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K30525503 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K30525503"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K28042514 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K28042514"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K47592780 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K47592780"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K96924184 du 19 f\u00e9vrier 2022",
      "url": "https://support.f5.com/csp/article/K96924184"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K11742742 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K11742742"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K26310765 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K26310765"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K68755210 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K68755210"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K08402414 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K08402414"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K41415626 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K41415626"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K30911244 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K30911244"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K54892865 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K54892865"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K82793463 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K82793463"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K91013510 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K91013510"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K53442005 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K53442005"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K30573026 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K30573026"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K93526903 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K93526903"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K41503304 du 19 f\u00e9vrier 2022",
      "url": "https://support.f5.com/csp/article/K41503304"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K16101409 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K16101409"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K34360320 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K34360320"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K29500533 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K29500533"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K57111075 du 19 f\u00e9vrier 2022",
      "url": "https://support.f5.com/csp/article/K57111075"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K50343028 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K50343028"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K44110411 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K44110411"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K24358905 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K24358905"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K08476614 du 19 janvier 2022",
      "url": "https://support.f5.com/csp/article/K08476614"
    }
  ]
}

CERTFR-2021-AVI-887
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits F5. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IQ BIG-IQ versions 7.x
F5 BIG-IQ BIG-IQ versions 6.1.0
F5 BIG-IP BIG-IP versions 13.x antérieures à 13.1.3.4
F5 BIG-IP BIG-IP versions 12.x antérieures à 12.1.5.1
F5 N/A Traffix SDC versions 5.2.0
F5 N/A Traffix SDC versions 5.1.0
F5 BIG-IP BIG-IP versions 14.x antérieures à 14.1.2.5
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IQ versions 7.x",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ versions 6.1.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP versions 13.x ant\u00e9rieures \u00e0 13.1.3.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP versions 12.x ant\u00e9rieures \u00e0 12.1.5.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "Traffix SDC versions 5.2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "Traffix SDC versions 5.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP versions 14.x ant\u00e9rieures \u00e0 14.1.2.5",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-14042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042"
    },
    {
      "name": "CVE-2018-14040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040"
    }
  ],
  "initial_release_date": "2021-11-19T00:00:00",
  "last_revision_date": "2021-11-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-887",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-11-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire et une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K19785240 du 18 novembre 2021",
      "url": "https://support.f5.com/csp/article/K19785240"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K48382137 du 18 novembre 2021",
      "url": "https://support.f5.com/csp/article/K48382137"
    }
  ]
}

CERTFR-2021-AVI-359
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans F5 BIG-IQ. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IQ BIG-IQ versions antérieures à 8.0.0
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IQ versions ant\u00e9rieures \u00e0 8.0.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22995"
    },
    {
      "name": "CVE-2021-22996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22996"
    },
    {
      "name": "CVE-2021-22997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22997"
    }
  ],
  "initial_release_date": "2021-05-12T00:00:00",
  "last_revision_date": "2021-05-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-359",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans F5 BIG-IQ. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans F5 BIG-IQ",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K16352404 du 11 mai 2021",
      "url": "https://support.f5.com/csp/article/K16352404"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K34074377 du 11 mai 2021",
      "url": "https://support.f5.com/csp/article/K34074377"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K13155201 du 11 mai 2021",
      "url": "https://support.f5.com/csp/article/K13155201"
    }
  ]
}

CERTFR-2021-AVI-275
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans F5 BIG-IP et BIG-IQ. Elles permettent à un attaquant de provoquer une exécution de code arbitraire.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IP BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 12.x antérieures à 12.1.5.1
F5 BIG-IQ BIG-IQ Centralized Management 7.x versions antérieures à 8.0.0
F5 BIG-IP BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 14.x antérieures à 14.1.2.42
F5 BIG-IQ BIG-IQ Centralized Management 6.x versions antérieures à 8.0.0
F5 BIG-IQ BIG-IQ Centralized Management 5.x versions antérieures à 8.0.0
F5 BIG-IP BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 11.x antérieures à 11.6.5.1
F5 BIG-IP BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.x antérieures à 15.1.0 ou 15.0.1.1
F5 BIG-IP BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 13.x antérieures à 13.1.3.2
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 12.x ant\u00e9rieures \u00e0 12.1.5.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management 7.x versions ant\u00e9rieures \u00e0 8.0.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 14.x ant\u00e9rieures \u00e0 14.1.2.42",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management 6.x versions ant\u00e9rieures \u00e0 8.0.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Centralized Management 5.x versions ant\u00e9rieures \u00e0 8.0.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 11.x ant\u00e9rieures \u00e0 11.6.5.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.x ant\u00e9rieures \u00e0 15.1.0 ou 15.0.1.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 13.x ant\u00e9rieures \u00e0 13.1.3.2",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-5873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-5873"
    }
  ],
  "initial_release_date": "2021-04-16T00:00:00",
  "last_revision_date": "2021-04-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-275",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans F5 BIG-IP et\nBIG-IQ. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans F5 BIG-IP et BIG-IQ",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K03585731 du 15 avril 2021",
      "url": "https://support.f5.com/csp/article/K03585731"
    }
  ]
}

CERTFR-2020-AVI-571
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans F5 BIG-IP et F5 BIG-IQ. Le serveur OpenSSH de l'équipement utilise par défaut des clés DSA inférieures à 2048 bits.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation). Pour les versions ne disposant pas de correctif, l'éditeur propose des mesures compensatoires.

None
Impacted products
Vendor Product Description
F5 BIG-IP BIG-IP 14.x versions antérieures à 14.1.2.4
F5 BIG-IQ BIG-IQ 5.x toutes versions
F5 BIG-IQ BIG-IQ 6.x toutes versions
F5 BIG-IQ BIG-IQ 7.x toutes versions
F5 BIG-IP BIG-IP 12.x versions antérieures à 12.1.5.2
F5 BIG-IP BIG-IP 13.x toutes versions
F5 BIG-IP BIG-IP 11.x toutes versions
F5 BIG-IP BIG-IP 15.x versions antérieures à 15.1.0.5 et 15.0.1.4
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IP 14.x versions ant\u00e9rieures \u00e0 14.1.2.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ 5.x toutes versions",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ 6.x toutes versions",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ 7.x toutes versions",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 12.x versions ant\u00e9rieures \u00e0 12.1.5.2",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 13.x toutes versions",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 11.x toutes versions",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 15.x versions ant\u00e9rieures \u00e0 15.1.0.5 et 15.0.1.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation). Pour les versions ne disposant\npas de correctif, l\u0027\u00e9diteur propose des mesures compensatoires.\n",
  "cves": [
    {
      "name": "CVE-2020-5917",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-5917"
    }
  ],
  "initial_release_date": "2020-09-15T00:00:00",
  "last_revision_date": "2020-09-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-571",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans F5 BIG-IP et F5 BIG-IQ. Le\nserveur OpenSSH de l\u0027\u00e9quipement utilise par d\u00e9faut des cl\u00e9s DSA\ninf\u00e9rieures \u00e0 2048 bits.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans F5 BIG-IP et BIG-IQ",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K43404629 du 26 ao\u00fbt 2020",
      "url": "https://support.f5.com/csp/article/K43404629?utm_source=f5support\u0026utm_medium=RSS"
    }
  ]
}

CERTFR-2015-AVI-162
Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans les produits F5. Elles permettent à un attaquant de provoquer un déni de service à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IQ F5 BIG-IQ Security versions 4.5.0 et antérieures
F5 BIG-IP F5 BIG-IP WOM versions 10.2.4 et antérieures
F5 BIG-IP F5 BIG-IP Link Controller versions 10.2.4 et antérieures
F5 BIG-IP F5 BIG-IP PSM versions 10.2.4 et antérieures
F5 BIG-IP F5 BIG-IP LTM versions 11.6.0 et antérieures
F5 BIG-IQ F5 BIG-IQ Cloud versions 4.5.0 et antérieures
F5 BIG-IP F5 BIG-IP APM versions 10.2.4 et antérieures
F5 BIG-IP F5 BIG-IP WOM versions 11.3.0 et antérieures
F5 BIG-IP F5 BIG-IP WebAccelerator versions 11.3.0 et antérieures
F5 N/A F5 Traffix SDC versions 4.1.0 et antérieures
F5 BIG-IP F5 BIG-IP AAM versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP ASM versions 11.6.0 et antérieures
F5 BIG-IQ F5 BIG-IQ ADC versions 4.5.0 et antérieures
F5 N/A F5 Entreprise Manager versions 2.3.0 et antérieures
F5 BIG-IP F5 BIG-IP ASM versions 10.2.4 et antérieures
F5 N/A F5 ARX versions 6.4.0 et antérieures
F5 BIG-IP F5 BIG-IP Link Controller versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP WebAccelerator versions 10.2.4 et antérieures
F5 N/A F5 Traffix SDC versions 3.5.1 et antérieures
F5 BIG-IP F5 BIG-IP Analytics versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP PEM versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP GTM versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP AFM versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP Edge Gateway versions 10.2.4 et antérieures
F5 BIG-IP F5 BIG-IP APM versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP GTM versions 10.2.4 et antérieures
F5 BIG-IQ F5 BIG-IQ Device versions 4.5.0 et antérieures
F5 BIG-IP F5 BIG-IP LTM versions 10.2.4 et antérieures
F5 N/A F5 Entreprise Manager versions 3.1.1 et antérieures
F5 BIG-IP F5 BIG-IP Edge Gateway versions 11.3.0 et antérieures
F5 BIG-IP F5 BIG-IP PSM versions 11.4.1 et antérieures
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "F5 BIG-IQ Security versions 4.5.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP WOM versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Link Controller versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP PSM versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP LTM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Cloud versions 4.5.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP APM versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP WOM versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP WebAccelerator versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Traffix SDC versions 4.1.0 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP AAM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP ASM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ ADC versions 4.5.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Entreprise Manager versions 2.3.0 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP ASM versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 ARX versions 6.4.0 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Link Controller versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP WebAccelerator versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Traffix SDC versions 3.5.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Analytics versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP PEM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP GTM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP AFM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Edge Gateway versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP APM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP GTM versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Device versions 4.5.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP LTM versions 10.2.4 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Entreprise Manager versions 3.1.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Edge Gateway versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP PSM versions 11.4.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-0227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0227"
    },
    {
      "name": "CVE-2014-9297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-9297"
    }
  ],
  "initial_release_date": "2015-04-15T00:00:00",
  "last_revision_date": "2015-04-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2015-AVI-162",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2015-04-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eF5\u003c/span\u003e. Elles permettent \u00e0 un attaquant de provoquer\nun d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol16392 du 09 avril 2015",
      "url": "https://support.f5.com/kb/en-us/solutions/public/16000/300/sol16392.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol16344 du 09 avril 2015",
      "url": "https://support.f5.com/kb/en-us/solutions/public/16000/300/sol16344.html"
    }
  ]
}

CERTFR-2014-AVI-533
Vulnerability from certfr_avis

Une vulnérabilité a été corrigée dans les produits F5. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IP F5 BIG-IP APM versions 11.5.1 et antérieures
F5 BIG-IQ F5 BIG-IQ Device versions 4.4.0 et antérieures
F5 BIG-IQ F5 BIG-IQ Security versions 4.4.0 et antérieures
F5 BIG-IP F5 BIG-IP ASM versions 11.5.1 et antérieures
F5 BIG-IP F5 BIG-IP WOM versions 11.3.0 et antérieures
F5 BIG-IP F5 BIG-IP WebAccelerator versions 11.3.0 et antérieures
F5 BIG-IQ F5 BIG-IQ Cloud versions 4.4.0 et antérieures
F5 BIG-IP F5 BIG-IP AAM versions 11.5.1 et antérieures
F5 BIG-IP F5 BIG-IP LTM versions 11.5.1 et antérieures
F5 BIG-IP F5 BIG-IP PEM versions 11.6.0 et antérieures
F5 BIG-IP F5 BIG-IP AFM versions 11.5.1 et antérieures
F5 BIG-IP F5 BIG-IP Analytics versions 11.5.1 et antérieures
F5 BIG-IP F5 BIG-IP Edge Gateway versions 11.3.0 et antérieures
F5 BIG-IP F5 BIG-IP PSM versions 11.4.1 et antérieures
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "F5 BIG-IP APM versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Device versions 4.4.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Security versions 4.4.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP ASM versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP WOM versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP WebAccelerator versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Cloud versions 4.4.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP AAM versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP LTM versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP PEM versions 11.6.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP AFM versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Analytics versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP Edge Gateway versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP PSM versions 11.4.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-8730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-8730"
    }
  ],
  "initial_release_date": "2014-12-18T00:00:00",
  "last_revision_date": "2014-12-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-533",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-12-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans les produits \u003cspan\nclass=\"textit\"\u003eF5\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol15882 du 12 d\u00e9cembre 2014",
      "url": "https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15882.html"
    }
  ]
}

CERTFR-2014-AVI-499
Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans les produits F5. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IQ F5 BIG-IQ Cloud versions antérieures à 4.4.0
F5 N/A F5 Enterprise Manager versions 2.3.0 et antérieures
F5 N/A F5 Enterprise Manager versions 3.1.1 et antérieures
F5 BIG-IQ F5 BIG-IQ Device versions antérieures à 4.4.0
F5 BIG-IQ F5 BIG-IQ Security versions antérieures à 4.4.0
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "F5 BIG-IQ Cloud versions ant\u00e9rieures \u00e0 4.4.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Enterprise Manager versions 2.3.0 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Enterprise Manager versions 3.1.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Device versions ant\u00e9rieures \u00e0 4.4.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ Security versions ant\u00e9rieures \u00e0 4.4.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-1173",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-1173"
    },
    {
      "name": "CVE-2012-2088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2088"
    }
  ],
  "initial_release_date": "2014-11-27T00:00:00",
  "last_revision_date": "2014-11-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-499",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-11-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eF5\u003c/span\u003e. Elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol15863 du 25 novembre 2014",
      "url": "https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15863.html"
    }
  ]
}

CERTFR-2014-AVI-395
Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans les produits F5. Elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IQ BIG-IQ
F5 N/A FirePass
F5 N/A ARX
F5 BIG-IP BIG-IP
F5 N/A Enterprise Manager
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IQ",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "FirePass",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "ARX",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "Enterprise Manager",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-3505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3505"
    },
    {
      "name": "CVE-2014-3511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3511"
    },
    {
      "name": "CVE-2014-3507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3507"
    },
    {
      "name": "CVE-2014-3506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3506"
    }
  ],
  "initial_release_date": "2014-09-22T00:00:00",
  "last_revision_date": "2014-09-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-395",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-09-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eF5\u003c/span\u003e. Elles permettent \u00e0 un attaquant de provoquer\nun d\u00e9ni de service \u00e0 distance, un contournement de la politique de\ns\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol15573 du 09 septembre 2014",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol15564 du 05 septembre 2014",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15564.html"
    }
  ]
}

CERTFR-2014-AVI-291
Vulnerability from certfr_avis

Une vulnérabilité a été corrigée dans les produits F5. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 BIG-IP BIG-IP PSM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP PEM (coté client) versions 11.5.1 et antérieures
F5 BIG-IQ BIG-IQ Device (coté client) versions 4.3.0 et antérieures
F5 BIG-IP BIG-IP WebAccelerator (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP LTM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP ASM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP Edge Gateway (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IQ BIG-IQ Security (coté client) versions 4.3.0 et antérieures
F5 N/A Enterprise Manager (coté client) versions 3.1.1 et antérieures
F5 BIG-IP BIG-IP Analytics (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP APM (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP Link Controller (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP PEM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP PSM (coté client) versions 11.4.1 et antérieures
F5 BIG-IP BIG-IP AFM (coté client) versions 11.5.1 et antérieures
F5 BIG-IQ BIG-IQ Cloud (coté client) versions 4.3.0 et antérieures
F5 BIG-IP BIG-IP WOM (coté client) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP ASM (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP AFM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP Link Controller (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP Analytics (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP WOM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP AAM (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP LTM (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP APM (coté serveur) versions 11.3.0 et antérieures
F5 BIG-IP BIG-IP GTM (coté client) versions 11.5.1 et antérieures
F5 BIG-IP BIG-IP GTM (coté serveur) versions 11.3.0 et antérieures
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IP PSM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP PEM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Device (cot\u00e9 client) versions 4.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP WebAccelerator (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP LTM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP ASM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Edge Gateway (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Security (cot\u00e9 client) versions 4.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "Enterprise Manager (cot\u00e9 client) versions 3.1.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Analytics (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP APM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Link Controller (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP PEM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP PSM (cot\u00e9 client) versions 11.4.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP AFM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ Cloud (cot\u00e9 client) versions 4.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP WOM (cot\u00e9 client) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP ASM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP AFM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Link Controller (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP Analytics (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP WOM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP AAM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP LTM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP APM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP GTM (cot\u00e9 client) versions 11.5.1 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP GTM (cot\u00e9 serveur) versions 11.3.0 et ant\u00e9rieures",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-0195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0195"
    }
  ],
  "initial_release_date": "2014-06-30T00:00:00",
  "last_revision_date": "2014-06-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-291",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-06-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans les produits \u003cspan\nclass=\"textit\"\u003eF5\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 sol15356 du 20 juin 2014",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15356.html"
    }
  ]
}

CERTFR-2014-AVI-191
Vulnerability from certfr_avis

Une vulnérabilité a été corrigée dans les produits F5. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
F5 N/A F5 FirePass version 7.0.0
F5 BIG-IQ F5 BIG-IQ de la version 4.0.0 à la version 4.3.0
F5 BIG-IP F5 BIG-IP de la version 10.0.0 à la version 10.2.4
F5 N/A F5 Enterprise Manager de la version 3.0.0 à la version 3.1.1
F5 BIG-IP F5 BIG-IP de la version 11.0.0 à la version 11.5.1
F5 N/A F5 Enterprise Manager de la version 2.1.0 à la version 2.3.0
F5 N/A F5 FirePass version 6.1.0
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "F5 FirePass version 7.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IQ de la version 4.0.0 \u00e0 la version 4.3.0",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP de la version 10.0.0 \u00e0 la version 10.2.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Enterprise Manager de la version 3.0.0 \u00e0 la version 3.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 BIG-IP de la version 11.0.0 \u00e0 la version 11.5.1",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 Enterprise Manager de la version 2.1.0 \u00e0 la version 2.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 FirePass version 6.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-4113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-4113"
    }
  ],
  "initial_release_date": "2014-04-17T00:00:00",
  "last_revision_date": "2014-10-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-191",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2014-04-17T00:00:00.000000"
    },
    {
      "description": "correction apport\u00e9e \u00e0 la r\u00e9f\u00e9rence CVE.",
      "revision_date": "2014-10-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans les produits \u003cspan\nclass=\"textit\"\u003eF5\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 SOL15169 du 14 avril 2014",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15169.html"
    }
  ]
}