CVE-2019-6637
First published: Wed Jul 03 2019(Updated: )
On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on arbitrary processes. The attack requires an authenticated user with role of "Guest" or greater privilege. Note: "No Access" cannot login so technically it's a role but a user with this access role cannot perform the attack.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Application Security Manager | >=12.1.0<12.1.4.1 | |
| F5 Application Security Manager | >=13.0.0<13.1.1.5 | |
| F5 Application Security Manager | >=14.0.0<14.0.0.5 | |
| F5 Application Security Manager | >=14.1.0<14.1.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2019-6637?
CVE-2019-6637 is considered a high-severity vulnerability due to its potential to cause system instability through excessive memory consumption.
How do I fix CVE-2019-6637?
To mitigate CVE-2019-6637, you should upgrade your F5 BIG-IP Application Security Manager to the latest version that is not affected by this vulnerability.
Which versions of F5 BIG-IP Application Security Manager are affected by CVE-2019-6637?
CVE-2019-6637 affects BIG-IP (ASM) versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4.
What type of attack does CVE-2019-6637 enable?
CVE-2019-6637 allows for application logic abuse of ASM REST endpoints which can lead to denial of service conditions.
Is there a workaround for CVE-2019-6637 if I cannot update immediately?
There are no official workarounds for CVE-2019-6637; upgrading to a patched version is the recommended approach to mitigate the vulnerability.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/last-modified-date
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/f5
- canonical/f5 application security manager
- version/f5 application security manager/12.1.0
- version/f5 application security manager/13.0.0
- version/f5 application security manager/14.0.0
- version/f5 application security manager/14.1.0