CVE-2018-5542: Input Validation
Published Jul 25, 2018
·Updated
F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.
Affected Software
39 affected components
F5 Big-ip Local Traffic Manager>=11.2.1<=11.6.3
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3
F5 Big-ip Local Traffic Manager>=13.0.0<=13.0.1
F5 Big-ip Application Acceleration Manager>=11.2.1<=11.6.3
F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3
F5 Big-ip Application Acceleration Manager>=13.0.0<=13.0.1
F5 BIG-IP Advanced Firewall Manager>=11.2.1<=11.6.3
F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3
F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.0.1
F5 BIG-IP Analytics>=11.2.1<=11.6.3
F5 BIG-IP Analytics>=12.1.0<=12.1.3
F5 BIG-IP Analytics>=13.0.0<=13.0.1
F5 BIG-IP Access Policy Manager>=11.2.1<=11.6.3
F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3
F5 BIG-IP Access Policy Manager>=13.0.0<=13.0.1
F5 BIG-IP Application Security Manager>=11.2.1<=11.6.3
F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3
F5 BIG-IP Application Security Manager>=13.0.0<=13.0.1
F5 Big-ip Domain Name System>=11.2.1<=11.6.3
F5 Big-ip Domain Name System>=12.1.0<=12.1.3
F5 Big-ip Domain Name System>=13.0.0<=13.0.1
F5 BIG-IP Edge Gateway>=11.2.1<=11.6.3
F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3
F5 BIG-IP Edge Gateway>=13.0.0<=13.0.1
F5 Big-ip Fraud Protection Service>=11.2.1<=11.6.3
F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.3
F5 Big-ip Fraud Protection Service>=13.0.0<=13.0.1
F5 Big-ip Global Traffic Manager>=11.2.1<=11.6.3
F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3
F5 Big-ip Global Traffic Manager>=13.0.0<=13.0.1
F5 Big-ip Link Controller>=11.2.1<=11.6.3
F5 Big-ip Link Controller>=12.1.0<=12.1.3
F5 Big-ip Link Controller>=13.0.0<=13.0.1
F5 Big-ip Policy Enforcement Manager>=11.2.1<=11.6.3
F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3
F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.0.1
F5 Big-ip Webaccelerator>=11.2.1<=11.6.3
F5 Big-ip Webaccelerator>=12.1.0<=12.1.3
F5 Big-ip Webaccelerator>=13.0.0<=13.0.1
Event History
Jul 25, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-5542?
CVE-2018-5542 is rated as high severity due to its potential impact on the security of monitored servers.
2
How do I fix CVE-2018-5542?
To remediate CVE-2018-5542, upgrade the affected F5 BIG-IP software to a version that is not vulnerable.
3
What products are affected by CVE-2018-5542?
CVE-2018-5542 impacts multiple versions of F5 BIG-IP products including Local Traffic Manager, Application Security Manager, and Advanced Firewall Manager.
4
What are the potential risks of exploiting CVE-2018-5542?
Exploiting CVE-2018-5542 could allow unauthorized access to sensitive data and services by bypassing server identity verification.
5
Are there any workarounds for CVE-2018-5542?
Currently, there are no effective workarounds for CVE-2018-5542 other than upgrading the affected systems.