CVE-2019-6632
First published: Wed Jul 03 2019(Updated: )
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Riverbed SteelApp Traffic Manager | >=12.1.0<12.1.4.1 | |
| Riverbed SteelApp Traffic Manager | >=13.0.0<13.1.1.5 | |
| Riverbed SteelApp Traffic Manager | >=14.0.0<14.0.0.5 | |
| Riverbed SteelApp Traffic Manager | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Application Acceleration Manager | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Application Acceleration Manager | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Application Acceleration Manager | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Application Acceleration Manager | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Advanced Firewall Manager | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Advanced Firewall Manager | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Advanced Firewall Manager | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Advanced Firewall Manager | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Analytics | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Analytics | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Analytics | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Analytics | >=14.1.0<14.1.0.6 | |
| F5 Access Policy Manager | >=12.1.0<12.1.4.1 | |
| F5 Access Policy Manager | >=13.0.0<13.1.1.5 | |
| F5 Access Policy Manager | >=14.0.0<14.0.0.5 | |
| F5 Access Policy Manager | >=14.1.0<14.1.0.6 | |
| F5 Application Security Manager | >=12.1.0<12.1.4.1 | |
| F5 Application Security Manager | >=13.0.0<13.1.1.5 | |
| F5 Application Security Manager | >=14.0.0<14.0.0.5 | |
| F5 Application Security Manager | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Edge Gateway | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Edge Gateway | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Edge Gateway | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Edge Gateway | >=14.1.0<14.1.0.6 | |
| Riverbed SteelApp Traffic Manager | >=12.1.0<12.1.4.1 | |
| Riverbed SteelApp Traffic Manager | >=13.0.0<13.1.1.5 | |
| Riverbed SteelApp Traffic Manager | >=14.0.0<14.0.0.5 | |
| Riverbed SteelApp Traffic Manager | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Link Controller | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Link Controller | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Link Controller | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Link Controller | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Policy Enforcement Manager | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Policy Enforcement Manager | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Policy Enforcement Manager | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Policy Enforcement Manager | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP WebAccelerator | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP WebAccelerator | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP WebAccelerator | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP WebAccelerator | >=14.1.0<14.1.0.6 | |
| F5 BIG-IP Fraud Protection Service | >=12.1.0<12.1.4.1 | |
| F5 BIG-IP Fraud Protection Service | >=13.0.0<13.1.1.5 | |
| F5 BIG-IP Fraud Protection Service | >=14.0.0<14.0.0.5 | |
| F5 BIG-IP Fraud Protection Service | >=14.1.0<14.1.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2019-6632?
CVE-2019-6632 has a severity rating of Medium.
How do I fix CVE-2019-6632?
To mitigate CVE-2019-6632, upgrade to the latest version of the affected F5 BIG-IP software.
What are the affected versions for CVE-2019-6632?
CVE-2019-6632 affects F5 BIG-IP versions 12.1.0 to 12.1.4, 13.0.0 to 13.1.1.5, and 14.0.0 to 14.1.0.6.
Can CVE-2019-6632 be exploited remotely?
No, exploitation of CVE-2019-6632 requires direct access to the affected configuration items.
What is the impact of CVE-2019-6632?
CVE-2019-6632 allows attackers to decrypt sensitive configuration items, potentially leading to unauthorized access.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/description
- agent/last-modified-date
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/f5
- canonical/riverbed steelapp traffic manager
- version/riverbed steelapp traffic manager/12.1.0
- version/riverbed steelapp traffic manager/13.0.0
- version/riverbed steelapp traffic manager/14.0.0
- version/riverbed steelapp traffic manager/14.1.0
- canonical/f5 big-ip application acceleration manager
- version/f5 big-ip application acceleration manager/12.1.0
- version/f5 big-ip application acceleration manager/13.0.0
- version/f5 big-ip application acceleration manager/14.0.0
- version/f5 big-ip application acceleration manager/14.1.0
- canonical/f5 big-ip advanced firewall manager
- version/f5 big-ip advanced firewall manager/12.1.0
- version/f5 big-ip advanced firewall manager/13.0.0
- version/f5 big-ip advanced firewall manager/14.0.0
- version/f5 big-ip advanced firewall manager/14.1.0
- canonical/f5 big-ip analytics
- version/f5 big-ip analytics/12.1.0
- version/f5 big-ip analytics/13.0.0
- version/f5 big-ip analytics/14.0.0
- version/f5 big-ip analytics/14.1.0
- canonical/f5 access policy manager
- version/f5 access policy manager/12.1.0
- version/f5 access policy manager/13.0.0
- version/f5 access policy manager/14.0.0
- version/f5 access policy manager/14.1.0
- canonical/f5 application security manager
- version/f5 application security manager/12.1.0
- version/f5 application security manager/13.0.0
- version/f5 application security manager/14.0.0
- version/f5 application security manager/14.1.0
- canonical/f5 big-ip
- version/f5 big-ip/12.1.0
- version/f5 big-ip/13.0.0
- version/f5 big-ip/14.0.0
- version/f5 big-ip/14.1.0
- canonical/f5 big-ip edge gateway
- version/f5 big-ip edge gateway/12.1.0
- version/f5 big-ip edge gateway/13.0.0
- version/f5 big-ip edge gateway/14.0.0
- version/f5 big-ip edge gateway/14.1.0
- canonical/f5 big-ip link controller
- version/f5 big-ip link controller/12.1.0
- version/f5 big-ip link controller/13.0.0
- version/f5 big-ip link controller/14.0.0
- version/f5 big-ip link controller/14.1.0
- canonical/f5 big-ip policy enforcement manager
- version/f5 big-ip policy enforcement manager/12.1.0
- version/f5 big-ip policy enforcement manager/13.0.0
- version/f5 big-ip policy enforcement manager/14.0.0
- version/f5 big-ip policy enforcement manager/14.1.0
- canonical/f5 big-ip webaccelerator
- version/f5 big-ip webaccelerator/12.1.0
- version/f5 big-ip webaccelerator/13.0.0
- version/f5 big-ip webaccelerator/14.0.0
- version/f5 big-ip webaccelerator/14.1.0
- canonical/f5 big-ip fraud protection service
- version/f5 big-ip fraud protection service/12.1.0
- version/f5 big-ip fraud protection service/13.0.0
- version/f5 big-ip fraud protection service/14.0.0
- version/f5 big-ip fraud protection service/14.1.0