CVE-2019-6629: High severity riverbed steelapp traffic manager vulnerability
On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Client SSL profile must have session tickets enabled and use DHE cipher suites to be affected. This only impacts the data plane, there is no impact to the control plane.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-6629?
CVE-2019-6629 is a vulnerability found in BIG-IP 14.1.0-14.1.0.5 that can cause TMM to fail and restart when undisclosed SSL traffic is sent to a virtual server configured with a Client SSL profile.
How does CVE-2019-6629 impact F5 Big-IP products?
CVE-2019-6629 impacts F5 Big-IP products including Local Traffic Manager, Application Acceleration Manager, Advanced Firewall Manager, Analytics, Access Policy Manager, Application Security Manager, Domain Name System, Edge Gateway, Global Traffic Manager, Link Controller, Policy Enforcement Manager, Webaccelerator, and Websafe.
What software versions are affected by CVE-2019-6629?
CVE-2019-6629 affects software versions from 14.1.0.1 to 14.1.0.5.
What is the severity of CVE-2019-6629?
CVE-2019-6629 has a severity value of 7.5, which is classified as high.
How can I fix CVE-2019-6629?
To fix CVE-2019-6629, it is recommended to upgrade the affected software versions to 14.1.0.6 or later.