CVE-2020-5885: Weak Encryption

Q: What is the severity of CVE-2020-5885?

CVE-2020-5885 is rated as a critical severity vulnerability due to its potential impact on sensitive cryptographic object transmission.

Q: How do I fix CVE-2020-5885?

To fix CVE-2020-5885, upgrade your F5 BIG-IP systems to a version that is not affected, such as version 15.1.0.2 or later.

Q: What systems are affected by CVE-2020-5885?

CVE-2020-5885 affects F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, and other related components in versions 12.1.0 to 15.1.0.1.

Q: What type of vulnerability is CVE-2020-5885?

CVE-2020-5885 is a control plane vulnerability that exposes sensitive data over an insecure communications channel.

Q: Is CVE-2020-5885 specific to high availability configurations?

Yes, CVE-2020-5885 specifically impacts F5 BIG-IP systems configured for connection mirroring in high availability pairs.

Published Apr 30, 2020

Updated

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.

Affected Software

44 affected components

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.5.1

F5 BIG-IP Access Policy Manager>=13.1.0<=13.1.3.3

F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Access Policy Manager>=15.0.0<=15.1.0.1

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.5.1

F5 BIG-IP Advanced Firewall Manager>=13.1.0<=13.1.3.3

F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.1.0.1

F5 BIG-IP Analytics>=12.1.0<=12.1.5.1

F5 BIG-IP Analytics>=13.1.0<=13.1.3.3

F5 BIG-IP Analytics>=14.1.0<=14.1.2.3

F5 BIG-IP Analytics>=15.0.0<=15.1.0.1

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.5.1

F5 Big-ip Application Acceleration Manager>=13.1.0<=13.1.3.3

F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.2.3

F5 Big-ip Application Acceleration Manager>=15.0.0<=15.1.0.1

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.5.1

F5 BIG-IP Application Security Manager>=13.1.0<=13.1.3.3

F5 BIG-IP Application Security Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Application Security Manager>=15.0.0<=15.1.0.1

F5 Big-ip Domain Name System>=12.1.0<=12.1.5.1

F5 Big-ip Domain Name System>=13.1.0<=13.1.3.3

F5 Big-ip Domain Name System>=14.1.0<=14.1.2.3

F5 Big-ip Domain Name System>=15.0.0<=15.1.0.1

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.5.1

F5 Big-ip Fraud Protection Service>=13.1.0<=13.1.3.3

F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.2.3

F5 Big-ip Fraud Protection Service>=15.0.0<=15.1.0.1

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.5.1

F5 Big-ip Global Traffic Manager>=13.1.0<=13.1.3.3

F5 Big-ip Global Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Global Traffic Manager>=15.0.0<=15.1.0.1

F5 Big-ip Link Controller>=12.1.0<=12.1.5.1

F5 Big-ip Link Controller>=13.1.0<=13.1.3.3

F5 Big-ip Link Controller>=14.1.0<=14.1.2.3

F5 Big-ip Link Controller>=15.0.0<=15.1.0.1

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.5.1

F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.3.3

F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Local Traffic Manager>=15.0.0<=15.1.0.1

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.5.1

F5 Big-ip Policy Enforcement Manager>=13.1.0<=13.1.3.3

F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.2.3

F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.1.0.1

Event History

Apr 30, 2020

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5885?

CVE-2020-5885 is rated as a critical severity vulnerability due to its potential impact on sensitive cryptographic object transmission.

How do I fix CVE-2020-5885?

To fix CVE-2020-5885, upgrade your F5 BIG-IP systems to a version that is not affected, such as version 15.1.0.2 or later.

What systems are affected by CVE-2020-5885?