CVE-2021-22998: Medium severity F5 BIG-IP Access Policy Manager vulnerability
Published Mar 31, 2021
·Updated
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds are not enforced in secure network address translation (SNAT) listeners. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected Software
84 affected components
F5 BIG-IP Access Policy Manager>=11.6.1<11.6.5.3
F5 BIG-IP Access Policy Manager>=12.1.0<12.1.5.3
F5 BIG-IP Access Policy Manager>=13.1.0<13.1.3.6
F5 BIG-IP Access Policy Manager>=14.1.0<14.1.4
F5 BIG-IP Access Policy Manager>=15.1.0<15.1.2.1
F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1.1
F5 BIG-IP Advanced Firewall Manager>=11.6.1<11.6.5.3
F5 BIG-IP Advanced Firewall Manager>=12.1.0<12.1.5.3
F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.3.6
F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.4
F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.2.1
F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1.1
F5 Big-ip Advanced Web Application Firewall>=11.6.1<11.6.5.3
F5 Big-ip Advanced Web Application Firewall>=12.1.0<12.1.5.3
F5 Big-ip Advanced Web Application Firewall>=13.1.0<13.1.3.6
F5 Big-ip Advanced Web Application Firewall>=14.1.0<14.1.4
F5 Big-ip Advanced Web Application Firewall>=15.1.0<15.1.2.1
F5 Big-ip Advanced Web Application Firewall>=16.0.0<16.0.1.1
F5 BIG-IP Analytics>=11.6.1<11.6.5.3
F5 BIG-IP Analytics>=12.1.0<12.1.5.3
F5 BIG-IP Analytics>=13.1.0<13.1.3.6
F5 BIG-IP Analytics>=14.1.0<14.1.4
F5 BIG-IP Analytics>=15.1.0<15.1.2.1
F5 BIG-IP Analytics>=16.0.0<16.0.1.1
F5 Big-ip Application Acceleration Manager>=11.6.1<11.6.5.3
F5 Big-ip Application Acceleration Manager>=12.1.0<12.1.5.3
F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.3.6
F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.4
F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.2.1
F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1.1
F5 BIG-IP Application Security Manager>=11.6.1<11.6.5.3
F5 BIG-IP Application Security Manager>=12.1.0<12.1.5.3
F5 BIG-IP Application Security Manager>=13.1.0<13.1.3.6
F5 BIG-IP Application Security Manager>=14.1.0<14.1.4
F5 BIG-IP Application Security Manager>=15.1.0<15.1.2.1
F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.1
F5 Big-ip Ddos Hybrid Defender>=11.6.1<11.6.5.3
F5 Big-ip Ddos Hybrid Defender>=12.1.0<12.1.5.3
F5 Big-ip Ddos Hybrid Defender>=13.1.0<13.1.3.6
F5 Big-ip Ddos Hybrid Defender>=14.1.0<14.1.4
F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.2.1
F5 Big-ip Ddos Hybrid Defender>=16.0.0<16.0.1.1
F5 Big-ip Domain Name System>=11.6.1<11.6.5.3
F5 Big-ip Domain Name System>=12.1.0<12.1.5.3
F5 Big-ip Domain Name System>=13.1.0<13.1.3.6
F5 Big-ip Domain Name System>=14.1.0<14.1.4
F5 Big-ip Domain Name System>=15.1.0<15.1.2.1
F5 Big-ip Domain Name System>=16.0.0<16.0.1.1
F5 Big-ip Fraud Protection Service>=11.6.1<11.6.5.3
F5 Big-ip Fraud Protection Service>=12.1.0<12.1.5.3
F5 Big-ip Fraud Protection Service>=13.1.0<13.1.3.6
F5 Big-ip Fraud Protection Service>=14.1.0<14.1.4
F5 Big-ip Fraud Protection Service>=15.1.0<15.1.2.1
F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1.1
F5 Big-ip Global Traffic Manager>=11.6.1<11.6.5.3
F5 Big-ip Global Traffic Manager>=12.1.0<12.1.5.3
F5 Big-ip Global Traffic Manager>=13.1.0<13.1.3.6
F5 Big-ip Global Traffic Manager>=14.1.0<14.1.4
F5 Big-ip Global Traffic Manager>=15.1.0<15.1.2.1
F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1.1
F5 Big-ip Link Controller>=11.6.1<11.6.5.3
F5 Big-ip Link Controller>=12.1.0<12.1.5.3
F5 Big-ip Link Controller>=13.1.0<13.1.3.6
F5 Big-ip Link Controller>=14.1.0<14.1.4
F5 Big-ip Link Controller>=15.1.0<15.1.2.1
F5 Big-ip Link Controller>=16.0.0<16.0.1.1
F5 Big-ip Local Traffic Manager>=11.6.1<11.6.5.3
F5 Big-ip Local Traffic Manager>=12.1.0<12.1.5.3
F5 Big-ip Local Traffic Manager>=13.1.0<13.1.3.6
F5 Big-ip Local Traffic Manager>=14.1.0<14.1.4
F5 Big-ip Local Traffic Manager>=15.1.0<15.1.2.1
F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1.1
F5 Big-ip Policy Enforcement Manager>=11.6.1<11.6.5.3
F5 Big-ip Policy Enforcement Manager>=12.1.0<12.1.5.3
F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.3.6
F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.4
F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.2.1
F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1.1
F5 SSL Orchestrator>=11.6.1<11.6.5.3
F5 SSL Orchestrator>=12.1.0<12.1.5.3
F5 SSL Orchestrator>=13.1.0<13.1.3.6
F5 SSL Orchestrator>=14.1.0<14.1.4
F5 SSL Orchestrator>=15.1.0<15.1.2.1
F5 SSL Orchestrator>=16.0.0<16.0.1.1
Event History
Mar 31, 2021
CVE Published
via MITRE·05:37 PM
Data Sourced
via MITRE·05:37 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22998?
CVE-2021-22998 has been rated as a critical severity vulnerability due to its impact on SYN flood protection in secure network address translation (SNAT) listeners.
2
How do I fix CVE-2021-22998?
To fix CVE-2021-22998, upgrade to F5 BIG-IP versions 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, or 11.6.5.3 or later.
3
What products are affected by CVE-2021-22998?
CVE-2021-22998 affects various F5 BIG-IP products including the Access Policy Manager, Advanced Firewall Manager, and Local Traffic Manager across specified versions.
4
Can CVE-2021-22998 lead to a denial-of-service attack?
Yes, CVE-2021-22998 can allow attackers to perform denial-of-service attacks by bypassing SYN flood protection thresholds.
5
Is there a workaround for CVE-2021-22998?
There is no official workaround for CVE-2021-22998; updating to a patched version is the recommended mitigation.