CVE-2020-5891: High severity f5 access policy manager vulnerability

Q: What is the severity of CVE-2020-5891?

CVE-2020-5891 is classified as a denial of service vulnerability.

Q: How do I fix CVE-2020-5891?

To fix CVE-2020-5891, update to the latest patched versions of the affected F5 BIG-IP software.

Q: Which versions are affected by CVE-2020-5891?

CVE-2020-5891 affects F5 BIG-IP versions ranging from 14.1.0 to 14.1.2.3, 15.0.0 to 15.0.1.2, and 15.1.0 to 15.1.0.1.

Q: Where can I find more details about CVE-2020-5891?

More details regarding CVE-2020-5891 can be found in the database of vulnerabilities maintained by F5.

Q: What is the potential impact of CVE-2020-5891?

The potential impact of CVE-2020-5891 includes service disruption due to denial of service attacks on the affected F5 BIG-IP virtual servers.

Published Apr 30, 2020

Updated

On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a virtual server configured with the Fallback Host setting and a server-side HTTP/2 profile.

Affected Software

27 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1.2

F5 BIG-IP Access Policy Manager>=15.1.0<=15.1.0.1

F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1.2

F5 BIG-IP Advanced Firewall Manager>=15.1.0<=15.1.0.1

F5 BIG-IP Analytics>=14.1.0<=14.1.2.3

F5 BIG-IP Analytics>=15.0.0<=15.0.1.2

F5 BIG-IP Analytics>=15.1.0<=15.1.0.1

F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.2.3

F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1.2

F5 Big-ip Application Acceleration Manager>=15.1.0<=15.1.0.1

F5 BIG-IP Application Security Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1.2

F5 BIG-IP Application Security Manager>=15.1.0<=15.1.0.1

F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.2.3

F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1.2

F5 Big-ip Fraud Protection Service>=15.1.0<=15.1.0.1

F5 Big-ip Link Controller>=14.1.0<=14.1.2.3

F5 Big-ip Link Controller>=15.0.0<=15.0.1.2

F5 Big-ip Link Controller>=15.1.0<=15.1.0.1

F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1.2

F5 Big-ip Local Traffic Manager>=15.1.0<=15.1.0.1

F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.2.3

F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1.2

F5 Big-ip Policy Enforcement Manager>=15.1.0<=15.1.0.1

Event History

Apr 30, 2020

CVE Published

via MITRE·08:57 PM

Data Sourced

via MITRE·08:57 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5891?

CVE-2020-5891 is classified as a denial of service vulnerability.

How do I fix CVE-2020-5891?

To fix CVE-2020-5891, update to the latest patched versions of the affected F5 BIG-IP software.

Which versions are affected by CVE-2020-5891?