CVE-2021-22973: High severity F5 BIG-IP Access Policy Manager vulnerability

Q: What is the severity of CVE-2021-22973?

CVE-2021-22973 is classified as a critical vulnerability due to its potential for out-of-bounds memory access, which could lead to arbitrary code execution.

Q: How do I fix CVE-2021-22973?

To fix CVE-2021-22973, you should upgrade to F5 BIG-IP versions 12.1.5, 13.1.3.5, 14.1.3.1, 15.1.2, or 16.0.1.1 or later.

Q: What types of F5 BIG-IP products are affected by CVE-2021-22973?

CVE-2021-22973 affects various versions of F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, and others.

Q: Which configurations are safe from CVE-2021-22973?

Configurations running F5 BIG-IP versions higher than the specified vulnerable versions are considered safe from CVE-2021-22973.

Q: Is CVE-2021-22973 remotely exploitable?

Yes, CVE-2021-22973 is remotely exploitable, allowing an attacker to potentially execute arbitrary code from a remote location.

Published Feb 12, 2021

Updated

On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected Software

50 affected components

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.5

F5 BIG-IP Access Policy Manager>=13.1.0<13.1.3.5

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.3.1

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.2

F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1.1

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.5

F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.3.5

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.3.1

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.2

F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1.1

F5 BIG-IP Analytics>=12.1.0<=12.1.5

F5 BIG-IP Analytics>=13.1.0<13.1.3.5

F5 BIG-IP Analytics>=14.1.0<14.1.3.1

F5 BIG-IP Analytics>=15.1.0<15.1.2

F5 BIG-IP Analytics>=16.0.0<16.0.1.1

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.5

F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.3.5

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.3.1

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.2

F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1.1

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.5

F5 BIG-IP Application Security Manager>=13.1.0<13.1.3.5

F5 BIG-IP Application Security Manager>=14.1.0<14.1.3.1

F5 BIG-IP Application Security Manager>=15.1.0<15.1.2

F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.1

F5 Big-ip Domain Name System>=12.1.0<=12.1.5

F5 Big-ip Domain Name System>=13.1.0<13.1.3.5

F5 Big-ip Domain Name System>=14.1.0<14.1.3.1

F5 Big-ip Domain Name System>=15.1.0<15.1.2

F5 Big-ip Domain Name System>=16.0.0<16.0.1.1

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.5

F5 Big-ip Fraud Protection Service>=13.1.0<13.1.3.5

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.3.1

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.2

F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1.1

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.5

F5 Big-ip Global Traffic Manager>=13.1.0<13.1.3.5

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.3.1

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.2

F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Link Controller>=12.1.0<=12.1.5

F5 Big-ip Link Controller>=13.1.0<13.1.3.5

F5 Big-ip Link Controller>=14.1.0<14.1.3.1

F5 Big-ip Link Controller>=15.1.0<15.1.2

F5 Big-ip Link Controller>=16.0.0<16.0.1.1

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.5

F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.3.5

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.3.1

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.2

F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1.1

Event History

Feb 12, 2021

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-22973?

CVE-2021-22973 is classified as a critical vulnerability due to its potential for out-of-bounds memory access, which could lead to arbitrary code execution.

How do I fix CVE-2021-22973?

To fix CVE-2021-22973, you should upgrade to F5 BIG-IP versions 12.1.5, 13.1.3.5, 14.1.3.1, 15.1.2, or 16.0.1.1 or later.

What types of F5 BIG-IP products are affected by CVE-2021-22973?