certfr_avis - certfr-2020-avi-571

CERTFR-2020-AVI-571

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans F5 BIG-IP et F5 BIG-IQ. Le serveur OpenSSH de l'équipement utilise par défaut des clés DSA inférieures à 2048 bits.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation). Pour les versions ne disposant pas de correctif, l'éditeur propose des mesures compensatoires.

None

Impacted products

Vendor	Product	Description
F5	BIG-IP	BIG-IP 14.x versions antérieures à 14.1.2.4
F5	BIG-IQ	BIG-IQ 5.x toutes versions
F5	BIG-IQ	BIG-IQ 6.x toutes versions
F5	BIG-IQ	BIG-IQ 7.x toutes versions
F5	BIG-IP	BIG-IP 12.x versions antérieures à 12.1.5.2
F5	BIG-IP	BIG-IP 13.x toutes versions
F5	BIG-IP	BIG-IP 11.x toutes versions
F5	BIG-IP	BIG-IP 15.x versions antérieures à 15.1.0.5 et 15.0.1.4

References

Title

Publication Time

Tags

Bulletin de sécurité F5 K43404629 du 26 août 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "BIG-IP 14.x versions ant\u00e9rieures \u00e0 14.1.2.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ 5.x toutes versions",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ 6.x toutes versions",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IQ 7.x toutes versions",
      "product": {
        "name": "BIG-IQ",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 12.x versions ant\u00e9rieures \u00e0 12.1.5.2",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 13.x toutes versions",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 11.x toutes versions",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "BIG-IP 15.x versions ant\u00e9rieures \u00e0 15.1.0.5 et 15.0.1.4",
      "product": {
        "name": "BIG-IP",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation). Pour les versions ne disposant\npas de correctif, l\u0027\u00e9diteur propose des mesures compensatoires.\n",
  "cves": [
    {
      "name": "CVE-2020-5917",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-5917"
    }
  ],
  "initial_release_date": "2020-09-15T00:00:00",
  "last_revision_date": "2020-09-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-571",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans F5 BIG-IP et F5 BIG-IQ. Le\nserveur OpenSSH de l\u0027\u00e9quipement utilise par d\u00e9faut des cl\u00e9s DSA\ninf\u00e9rieures \u00e0 2048 bits.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans F5 BIG-IP et BIG-IQ",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K43404629 du 26 ao\u00fbt 2020",
      "url": "https://support.f5.com/csp/article/K43404629?utm_source=f5support\u0026utm_medium=RSS"
    }
  ]
}

CVE-2020-5917 (GCVE-0-2020-5917)

Vulnerability from cvelistv5

Published

2020-08-26 14:06

Modified

2024-08-04 08:47

Severity ?

CWE

MitM

Summary

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure.

References

URL

Tags

https://support.f5.com/csp/article/K43404629

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	BIG-IP, BIG-IQ	Version: BIG-IP 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, 11.6.1-11.6.5.2 Version: BIG-IQ 5.2.0-7.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:47:40.928Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K43404629"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIG-IP, BIG-IQ",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "BIG-IP 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, 11.6.1-11.6.5.2"
            },
            {
              "status": "affected",
              "version": "BIG-IQ 5.2.0-7.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "MitM",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-26T14:06:50",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.f5.com/csp/article/K43404629"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "f5sirt@f5.com",
          "ID": "CVE-2020-5917",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIG-IP, BIG-IQ",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "BIG-IP 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, 11.6.1-11.6.5.2"
                          },
                          {
                            "version_value": "BIG-IQ 5.2.0-7.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "MitM"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.f5.com/csp/article/K43404629",
              "refsource": "MISC",
              "url": "https://support.f5.com/csp/article/K43404629"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2020-5917",
    "datePublished": "2020-08-26T14:06:50",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:47:40.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2020-AVI-571

Vulnerability from certfr_avis

Solution

CVE-2020-5917 (GCVE-0-2020-5917)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature