CVE-2018-15326: High severity f5 access policy manager vulnerability

Q: What is the severity of CVE-2018-15326?

CVE-2018-15326 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2018-15326?

To mitigate CVE-2018-15326, ensure that the BIG-IP APM system is updated to a version that addresses the vulnerability.

Q: What software versions are affected by CVE-2018-15326?

CVE-2018-15326 affects F5 BIG-IP Access Policy Manager versions 11.6.0 through 11.6.3.2, 12.1.0 through 12.1.3.5, 13.0.0 through 13.1.0.7, and 14.0.0 through 14.0.0.2.

Q: What is the impact of CVE-2018-15326?

The impact of CVE-2018-15326 is that revoked certificates may be considered valid, which can lead to unauthorized access.

Q: When was CVE-2018-15326 reported?

CVE-2018-15326 was reported in the year 2018.

Published Oct 31, 2018

Updated

In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List.

Affected Software

4 affected components

F5 BIG-IP Access Policy Manager>=11.6.0<=11.6.3.2

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3.5

F5 BIG-IP Access Policy Manager>=13.0.0<=13.1.0.7

F5 BIG-IP Access Policy Manager>=14.0.0<=14.0.0.2

Event History

Oct 31, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-15326?

CVE-2018-15326 is classified as a medium severity vulnerability.

How do I fix CVE-2018-15326?

To mitigate CVE-2018-15326, ensure that the BIG-IP APM system is updated to a version that addresses the vulnerability.

What software versions are affected by CVE-2018-15326?