CVE-2020-5859: High severity F5 BIG-IP Access Policy Manager vulnerability
Published Mar 27, 2020
·Updated
On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.
Affected Software
11 affected components
F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1.1
F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1.1
F5 BIG-IP Analytics>=15.0.0<=15.0.1.1
F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1.1
F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1.1
F5 Big-ip Domain Name System>=15.0.0<=15.0.1.1
F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1.1
F5 Big-ip Global Traffic Manager>=15.0.0<=15.0.1.1
F5 Big-ip Link Controller>=15.0.0<=15.0.1.1
F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1.1
F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1.1
Event History
Mar 27, 2020
CVE Published
via MITRE·02:29 PM
Data Sourced
via MITRE·02:29 PM
DescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-5859?
CVE-2020-5859 has a severity rating that indicates a potential risk due to the possibility of TMM producing a core file.
2
How do I fix CVE-2020-5859?
To fix CVE-2020-5859, upgrade your affected F5 BIG-IP software to the latest version beyond 15.0.1.1.
3
Which products are affected by CVE-2020-5859?
CVE-2020-5859 affects various F5 BIG-IP products including Access Policy Manager, Advanced Firewall Manager, and others in version range 15.0.0 to 15.0.1.1.
4
What exploit scenarios exist for CVE-2020-5859?
CVE-2020-5859 may allow attackers to cause unexpected behavior by sending specially formatted HTTP/3 messages.
5
Is there a workaround for CVE-2020-5859?
Currently, there is no specific workaround for CVE-2020-5859, so updating to a secure version is recommended.