CVE-2019-6673: High severity f5 access policy manager vulnerability
Published Nov 27, 2019
·Updated
On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).
Affected Software
16 affected components
F5 BIG-IP Access Policy Manager>=14.0.0<=14.1.2
F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1
F5 BIG-IP Advanced Firewall Manager>=14.0.0<=14.1.2
F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1
F5 Big-ip Application Acceleration Manager>=14.0.0<=14.1.2
F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1
F5 BIG-IP Application Security Manager>=14.0.0<=14.1.2
F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1
F5 Big-ip Fraud Protection Service>=14.0.0<=14.1.2
F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1
F5 Big-ip Link Controller>=14.0.0<=14.1.2
F5 Big-ip Link Controller>=15.0.0<=15.0.1
F5 Big-ip Local Traffic Manager>=14.0.0<=14.1.2
F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1
F5 Big-ip Policy Enforcement Manager>=14.0.0<=14.1.2
F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1
Event History
Nov 27, 2019
CVE Published
via MITRE·09:30 PM
Data Sourced
via MITRE·09:30 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-6673?
CVE-2019-6673 is classified as a medium severity vulnerability.
2
How do I fix CVE-2019-6673?
To fix CVE-2019-6673, upgrade to one of the fixed versions of the affected products listed in the vulnerability details.
3
Which versions are affected by CVE-2019-6673?
CVE-2019-6673 affects F5 BIG-IP versions 14.0.0 to 14.1.2 and 15.0.0 to 15.0.1.
4
What impact does CVE-2019-6673 have on BIG-IP?
CVE-2019-6673 can cause a disruption of service provided by the Traffic Management Microkernel when specific crafted requests are made.
5
Is CVE-2019-6673 exploitable remotely?
Yes, CVE-2019-6673 can be exploited remotely when the BIG-IP is configured in HTTP/2 Full Proxy mode.