CVE-2019-6648: Medium severity f5 big-ip container ingress services vulnerability

Published Sep 4, 2019

Updated

On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration.

Affected Software

2 affected components

F5 Container Ingress Service=1.9.0

redhat Openshift

Event History

Sep 4, 2019

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2019-6648.

What is the severity of CVE-2019-6648?

The severity of CVE-2019-6648 is medium with a severity value of 4.4.

Which software versions are affected by CVE-2019-6648?

Version 1.9.0 of F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) are affected by CVE-2019-6648.

What is the risk of CVE-2019-6648?

CVE-2019-6648 poses a risk as the log files of F5 Container Ingress Service (CIS) may contain sensitive information such as SSL Private Keys and Private key Passphrases.

How can I mitigate CVE-2019-6648?

To mitigate CVE-2019-6648, ensure that DEBUG logging is disabled in F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr).