CVE-2018-5532: Medium severity riverbed steelapp traffic manager vulnerability
On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5532?
CVE-2018-5532 has been classified as a high-severity vulnerability that may allow for outdated DNS data to be used after a record has been revoked.
How do I fix CVE-2018-5532?
To mitigate CVE-2018-5532, it is recommended to upgrade to a patched version of F5 BIG-IP software beyond the affected versions listed in the vulnerability report.
Which versions of F5 BIG-IP are affected by CVE-2018-5532?
CVE-2018-5532 affects F5 BIG-IP versions 11.2.1 to 11.5.6, 11.6.0 to 11.6.3.1, 12.1.0 to 12.1.2, and 13.0.0.
Can CVE-2018-5532 lead to data exposure?
Yes, CVE-2018-5532 can lead to data exposure as it allows for the potential use of cached DNS records after they have been revoked.
Is there a workaround for CVE-2018-5532?
While upgrading to a secure version is the best solution, temporary measures may include monitoring DNS requests to identify and handle unauthorized caches.