CVE-2018-15330: Input Validation

Q: What is the severity of CVE-2018-15330?

CVE-2018-15330 has been classified as a medium severity vulnerability due to its potential impact on system stability.

Q: How do I fix CVE-2018-15330?

To mitigate CVE-2018-15330, users should upgrade their BIG-IP systems to versions beyond 14.0.0.2, 13.1.1.1, or 12.1.3.7.

Q: What systems are affected by CVE-2018-15330?

CVE-2018-15330 affects F5 BIG-IP Local Traffic Manager, Application Security Manager, and several other BIG-IP modules across specified versions.

Q: What happens when CVE-2018-15330 is exploited?

Exploitation of CVE-2018-15330 may lead to a fatal error in the BIG-IP system, causing the Traffic Management Microkernel (TMM) to create a core file.

Q: Is there a known exploit for CVE-2018-15330?

As of now, there is no public information indicating an active exploit for CVE-2018-15330, but it is advisable to apply the recommended patches.

Published Dec 20, 2018

Updated

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to produce a core file.

Affected Software

39 affected components

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3.7

F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.1.1

F5 Big-ip Local Traffic Manager>=14.0.0<=14.0.0.2

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3.7

F5 Big-ip Application Acceleration Manager>=13.0.0<=13.1.1.1

F5 Big-ip Application Acceleration Manager>=14.0.0<=14.0.0.2

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3.7

F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Advanced Firewall Manager>=14.0.0<=14.0.0.2

F5 BIG-IP Analytics>=12.1.0<=12.1.3.7

F5 BIG-IP Analytics>=13.0.0<=13.1.1.1

F5 BIG-IP Analytics>=14.0.0<=14.0.0.2

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3.7

F5 BIG-IP Access Policy Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Access Policy Manager>=14.0.0<=14.0.0.2

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3.7

F5 BIG-IP Application Security Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Application Security Manager>=14.0.0<=14.0.0.2

F5 Big-ip Domain Name System>=12.1.0<=12.1.3.7

F5 Big-ip Domain Name System>=13.0.0<=13.1.1.1

F5 Big-ip Domain Name System>=14.0.0<=14.0.0.2

F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3.7

F5 BIG-IP Edge Gateway>=13.0.0<=13.1.1.1

F5 BIG-IP Edge Gateway>=14.0.0<=14.0.0.2

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.3.7

F5 Big-ip Fraud Protection Service>=13.0.0<=13.1.1.1

F5 Big-ip Fraud Protection Service>=14.0.0<=14.0.0.2

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3.7

F5 Big-ip Global Traffic Manager>=13.0.0<=13.1.1.1

F5 Big-ip Global Traffic Manager>=14.0.0<=14.0.0.2

F5 Big-ip Link Controller>=12.1.0<=12.1.3.7

F5 Big-ip Link Controller>=13.0.0<=13.1.1.1

F5 Big-ip Link Controller>=14.0.0<=14.0.0.2

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3.7

F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.1.1.1

F5 Big-ip Policy Enforcement Manager>=14.0.0<=14.0.0.2

F5 Big-ip Webaccelerator>=12.1.0<=12.1.3.7

F5 Big-ip Webaccelerator>=13.0.0<=13.1.1.1

F5 Big-ip Webaccelerator>=14.0.0<=14.0.0.2

Event History

Dec 20, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-15330?

CVE-2018-15330 has been classified as a medium severity vulnerability due to its potential impact on system stability.

How do I fix CVE-2018-15330?

To mitigate CVE-2018-15330, users should upgrade their BIG-IP systems to versions beyond 14.0.0.2, 13.1.1.1, or 12.1.3.7.

What systems are affected by CVE-2018-15330?