CVE-2020-5939: High severity f5 access policy manager vulnerability

Q: What systems are affected by CVE-2020-5939?

CVE-2020-5939 affects BIG-IP Virtual Edition systems on VMware using Intel-based 85299 NIC cards with SR-IOV enabled in specific versions.

Q: What is the severity of CVE-2020-5939?

The severity of CVE-2020-5939 is considered high due to the potential system failure it can cause.

Q: How can I mitigate CVE-2020-5939?

Mitigation for CVE-2020-5939 involves upgrading to the patched versions of the F5 BIG-IP software.

Q: What versions do I need to update to prevent CVE-2020-5939?

You should update your F5 BIG-IP software to versions higher than 16.0.0.1, 15.1.0.3, 15.0.1.3, 14.1.2.6, and 13.1.3.4.

Q: Does CVE-2020-5939 affect all F5 BIG-IP models?

No, CVE-2020-5939 specifically affects the BIG-IP Virtual Edition models with the mentioned configurations.

Published Nov 5, 2020

Updated

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic.

Affected Software

56 affected components

F5 BIG-IP Access Policy Manager>=13.1.0<=13.1.3

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.2.7

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.0.4

F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1

F5 BIG-IP Advanced Firewall Manager>=13.1.0<=13.1.3

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.2.7

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.0.4

F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1

F5 Big-ip Advanced Web Application Firewall>=13.1.0<=13.1.3

F5 Big-ip Advanced Web Application Firewall>=14.1.0<14.1.2.7

F5 Big-ip Advanced Web Application Firewall>15.1.0<15.1.0.4

F5 Big-ip Advanced Web Application Firewall>=16.0.0<16.0.1

F5 BIG-IP Analytics>=13.1.0<=13.1.3

F5 BIG-IP Analytics>=14.1.0<14.1.2.7

F5 BIG-IP Analytics>=15.1.0<15.1.0.4

F5 BIG-IP Analytics>=16.0.0<16.0.1

F5 Big-ip Application Acceleration Manager>=13.1.0<=13.1.3

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.2.7

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.0.4

F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1

F5 BIG-IP Application Security Manager>=13.1.0<=13.1.3

F5 BIG-IP Application Security Manager>=14.1.0<14.1.2.7

F5 BIG-IP Application Security Manager>=15.1.0<15.1.0.4

F5 BIG-IP Application Security Manager>=16.0.0<16.0.1

F5 Big-ip Ddos Hybrid Defender>=13.1.0<=13.1.3

F5 Big-ip Ddos Hybrid Defender>=14.1.0<14.1.2.7

F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.0.4

F5 Big-ip Ddos Hybrid Defender>=16.0.0<16.0.1

F5 Big-ip Domain Name System>=13.1.0<=13.1.3

F5 Big-ip Domain Name System>=14.1.0<14.1.2.7

F5 Big-ip Domain Name System>=15.1.0<15.1.0.4

F5 Big-ip Domain Name System>=16.0.0<16.0.1

F5 Big-ip Fraud Protection Service>=13.1.0<=13.1.3

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.2.7

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.0.4

F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1

F5 Big-ip Global Traffic Manager>=13.1.0<=13.1.3

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.2.7

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.0.4

F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1

F5 Big-ip Link Controller>=13.1.0<=13.1.3

F5 Big-ip Link Controller>=14.1.0<14.1.2.7

F5 Big-ip Link Controller>=15.1.0<15.1.0.4

F5 Big-ip Link Controller>=16.0.0<16.0.1

F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.3

F5 Big-ip Local Traffic Manager>=14.1.0<14.1.2.7

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.0.4

F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1

F5 Big-ip Policy Enforcement Manager>=13.1.0<=13.1.3

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.2.7

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.0.4

F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1

F5 BIG-IP SSL Orchestrator>=13.1.0<=13.1.3

F5 BIG-IP SSL Orchestrator>=14.1.0<14.1.2.7

F5 BIG-IP SSL Orchestrator>=15.1.0<15.1.0.4

F5 BIG-IP SSL Orchestrator>=16.0.0<16.0.1

Event History

Nov 5, 2020

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

DescriptionWeakness

Frequently Asked Questions

What systems are affected by CVE-2020-5939?

CVE-2020-5939 affects BIG-IP Virtual Edition systems on VMware using Intel-based 85299 NIC cards with SR-IOV enabled in specific versions.

What is the severity of CVE-2020-5939?

The severity of CVE-2020-5939 is considered high due to the potential system failure it can cause.

How can I mitigate CVE-2020-5939?