CVE-2020-5875: High severity f5 access policy manager vulnerability

Q: What is the severity of CVE-2020-5875?

CVE-2020-5875 has been rated as a high severity vulnerability due to its potential impact on system availability.

Q: How do I fix CVE-2020-5875?

To remedy CVE-2020-5875, you should upgrade your F5 BIG-IP software to versions 15.0.1 or 14.1.2.4 and above.

Q: Which F5 BIG-IP versions are affected by CVE-2020-5875?

CVE-2020-5875 affects F5 BIG-IP versions 15.0.0 to 15.0.1 and 14.1.0 to 14.1.2.3.

Q: What are the consequences of not addressing CVE-2020-5875?

Failing to address CVE-2020-5875 may lead to unexpected system restarts and potential service downtime while processing SSL traffic.

Q: Is CVE-2020-5875 related to SSL traffic?

Yes, CVE-2020-5875 specifically concerns the handling of SSL traffic by the Traffic Management Microkernel in F5 BIG-IP systems.

Published Apr 30, 2020

Updated

On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy.

Affected Software

22 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1

F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1

F5 BIG-IP Analytics>=14.1.0<=14.1.2.3

F5 BIG-IP Analytics>=15.0.0<=15.0.1

F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.2.3

F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1

F5 BIG-IP Application Security Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1

F5 Big-ip Domain Name System>=14.1.0<=14.1.2.3

F5 Big-ip Domain Name System>=15.0.0<=15.0.1

F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.2.3

F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1

F5 Big-ip Global Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Global Traffic Manager>=15.0.0<=15.0.1

F5 Big-ip Link Controller>=14.1.0<=14.1.2.3

F5 Big-ip Link Controller>=15.0.0<=15.0.1

F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1

F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.2.3

F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1

Event History

Apr 30, 2020

CVE Published

via MITRE·08:27 PM

Data Sourced

via MITRE·08:27 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5875?

CVE-2020-5875 has been rated as a high severity vulnerability due to its potential impact on system availability.

How do I fix CVE-2020-5875?

To remedy CVE-2020-5875, you should upgrade your F5 BIG-IP software to versions 15.0.1 or 14.1.2.4 and above.

Which F5 BIG-IP versions are affected by CVE-2020-5875?