CVE-2020-5862: High severity F5 BIG-IP Access Policy Manager vulnerability

Q: What is the severity of CVE-2020-5862?

CVE-2020-5862 has been identified as a critical vulnerability affecting certain versions of BIG-IP, leading to potential service outage.

Q: How do I fix CVE-2020-5862?

To fix CVE-2020-5862, you should upgrade to the fixed versions of the affected BIG-IP platforms as specified in the security advisory.

Q: Which versions are affected by CVE-2020-5862?

CVE-2020-5862 affects F5 BIG-IP versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2.

Q: Does CVE-2020-5862 affect F5 devices on platforms other than AWS?

No, CVE-2020-5862 specifically affects F5 BIG-IP devices on AWS systems and does not impact other platforms.

Q: What are the potential impacts of CVE-2020-5862?

The potential impacts of CVE-2020-5862 include crashing or halting traffic processing on affected F5 BIG-IP products.

Published Mar 27, 2020

Updated

On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS.

Affected Software

33 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.2.2

F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1.1

F5 BIG-IP Access Policy Manager>=15.1.0<=15.1.0.1

F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.2

F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1.1

F5 BIG-IP Advanced Firewall Manager>=15.1.0<=15.1.0.1

F5 BIG-IP Analytics>=14.1.0<=14.1.2

F5 BIG-IP Analytics>=15.0.0<=15.0.1.1

F5 BIG-IP Analytics>=15.1.0<=15.1.0.1

F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.2

F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1.1

F5 Big-ip Application Acceleration Manager>=15.1.0<=15.1.0.1

F5 BIG-IP Application Security Manager>=14.1.0<=14.1.2

F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1.1

F5 BIG-IP Application Security Manager>=15.1.0<=15.1.0.1

F5 Big-ip Domain Name System>=14.1.0<=14.1.2

F5 Big-ip Domain Name System>=15.0.0<=15.0.1.1

F5 Big-ip Domain Name System>=15.1.0<=15.1.0.1

F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.2

F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1.1

F5 Big-ip Fraud Protection Service>=15.1.0<=15.1.0.1

F5 Big-ip Global Traffic Manager>=14.1.0<=14.1.2

F5 Big-ip Global Traffic Manager>=15.0.0<=15.0.1.1

F5 Big-ip Global Traffic Manager>=15.1.0<=15.1.0.1

F5 Big-ip Link Controller>=14.1.0<=14.1.2

F5 Big-ip Link Controller>=15.0.0<=15.0.1.1

F5 Big-ip Link Controller>=15.1.0<=15.1.0.1

F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.2

F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1.1

F5 Big-ip Local Traffic Manager>=15.1.0<=15.1.0.1

F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.2

F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1.1

F5 Big-ip Policy Enforcement Manager>=15.1.0<=15.1.0.1

Event History

Mar 27, 2020

CVE Published

via MITRE·02:41 PM

Data Sourced

via MITRE·02:41 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-5862?

CVE-2020-5862 has been identified as a critical vulnerability affecting certain versions of BIG-IP, leading to potential service outage.

How do I fix CVE-2020-5862?

To fix CVE-2020-5862, you should upgrade to the fixed versions of the affected BIG-IP platforms as specified in the security advisory.

Which versions are affected by CVE-2020-5862?