CVE-2018-5524: Medium severity F5 Big-ip Application Acceleration Manager vulnerability

Q: What is the severity of CVE-2018-5524?

CVE-2018-5524 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2018-5524?

To fix CVE-2018-5524, you should upgrade your F5 BIG-IP software to a version that is not affected, specifically 13.1.0.6 or later, 12.1.3.2 or later, or 11.6.3.2 or later.

Q: What software versions are affected by CVE-2018-5524?

CVE-2018-5524 affects F5 BIG-IP versions 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, and 11.6.1 HF2-11.6.3.1.

Q: What kind of services are impacted by CVE-2018-5524?

CVE-2018-5524 impacts virtual servers configured with Client SSL or Server SSL profiles utilizing network hardware security module (HSM) functionality.

Q: Is CVE-2018-5524 widely exploited?

As of now, there is no evidence indicating that CVE-2018-5524 is being actively exploited in the wild.

Published Jun 1, 2018

Updated

Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profiles which make use of network hardware security module (HSM) functionality are exposed and impacted by this issue.

Affected Software

33 affected components

F5 Big-ip Application Acceleration Manager>=11.6.1<=11.6.3

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3

F5 Big-ip Application Acceleration Manager>=13.0.0<=13.0.1

F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.3

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3

F5 Big-ip Local Traffic Manager>=13.0.0<=13.0.1

F5 BIG-IP Advanced Firewall Manager>=11.6.1<=11.6.3

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3

F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.0.1

F5 BIG-IP Analytics>=11.6.1<=11.6.3

F5 BIG-IP Analytics>=12.1.0<=12.1.3

F5 BIG-IP Analytics>=13.0.0<=13.0.1

F5 BIG-IP Access Policy Manager>=11.6.1<=11.6.3

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3

F5 BIG-IP Access Policy Manager>=13.0.0<=13.0.1

F5 BIG-IP Application Security Manager>=11.6.1<=11.6.3

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3

F5 BIG-IP Application Security Manager>=13.0.0<=13.0.1

F5 BIG-IP Edge Gateway>=11.6.1<=11.6.3

F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3

F5 BIG-IP Edge Gateway>=13.0.0<=13.0.1

F5 Big-ip Link Controller>=11.6.1<=11.6.3

F5 Big-ip Link Controller>=12.1.0<=12.1.3

F5 Big-ip Link Controller>=13.0.0<=13.0.1

F5 Big-ip Policy Enforcement Manager>=11.6.1<=11.6.3

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3

F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.0.1

F5 Big-ip Webaccelerator>=11.6.1<=11.6.3

F5 Big-ip Webaccelerator>=12.1.0<=12.1.3

F5 Big-ip Webaccelerator>=13.0.0<=13.0.1

F5 Big-ip Fraud Protection Service>=11.6.1<=11.6.3

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.3

F5 Big-ip Fraud Protection Service>=13.0.0<=13.0.1

Event History

Jun 1, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Data Sourced

via NVD·02:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2018-5524?

CVE-2018-5524 is classified as a medium severity vulnerability.

How do I fix CVE-2018-5524?

To fix CVE-2018-5524, you should upgrade your F5 BIG-IP software to a version that is not affected, specifically 13.1.0.6 or later, 12.1.3.2 or later, or 11.6.3.2 or later.

What software versions are affected by CVE-2018-5524?