CVE-2021-23000: High severity F5 BIG-IP Access Policy Manager vulnerability

Q: What is CVE-2021-23000?

CVE-2021-23000 is a vulnerability that affects F5 BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, allowing malicious requests to cause a denial of service (DoS) condition.

Q: Which F5 products are affected by CVE-2021-23000?

CVE-2021-23000 affects F5 BIG-IP Access Policy Manager, F5 BIG-IP Advanced Firewall Manager, F5 Big-ip Advanced Web Application Firewall, F5 BIG-IP Analytics, F5 Big-ip Application Acceleration Manager, F5 BIG-IP Application Security Manager, F5 Big-ip Ddos Hybrid Defender, F5 Big-ip Domain Name System, F5 Big-ip Fraud Protection Service, F5 Big-ip Global Traffic Manager, F5 Big-ip Link Controller, F5 Big-ip Local Traffic Manager, F5 Big-ip Policy Enforcement Manager, and F5 SSL Orchestrator.

Q: What is the severity of CVE-2021-23000?

CVE-2021-23000 has a severity rating of 7.5, which is classified as high.

Q: How can I fix CVE-2021-23000?

To fix CVE-2021-23000, upgrade your BIG-IP system to a version higher than 13.1.3.6 or 12.1.5.2, as recommended by F5.

Q: Where can I find more information about CVE-2021-23000?

You can find more information about CVE-2021-23000 on the F5 support website at the following link: https://support.f5.com/csp/article/K34441555

Published Mar 31, 2021

Updated

On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected Software

28 affected components

F5 BIG-IP Access Policy Manager>=13.1.3.4<13.1.3.6

F5 BIG-IP Access Policy Manager=12.1.5.2

F5 BIG-IP Advanced Firewall Manager>=13.1.3.4<13.1.3.6

F5 BIG-IP Advanced Firewall Manager=12.1.5.2

F5 Big-ip Advanced Web Application Firewall>=13.1.3.4<13.1.3.6

F5 Big-ip Advanced Web Application Firewall=12.1.5.2

F5 BIG-IP Analytics>=13.1.3.4<13.1.3.6

F5 BIG-IP Analytics=12.1.5.2

F5 Big-ip Application Acceleration Manager>=13.1.3.4<13.1.3.6

F5 Big-ip Application Acceleration Manager=12.1.5.2

F5 BIG-IP Application Security Manager>=13.1.3.4<13.1.3.6

F5 BIG-IP Application Security Manager=12.1.5.2

F5 Big-ip Ddos Hybrid Defender>=13.1.3.4<13.1.3.6

F5 Big-ip Ddos Hybrid Defender=12.1.5.2

F5 Big-ip Domain Name System>=13.1.3.4<13.1.3.6

F5 Big-ip Domain Name System=12.1.5.2

F5 Big-ip Fraud Protection Service>=13.1.3.4<13.1.3.6

F5 Big-ip Fraud Protection Service=12.1.5.2

F5 Big-ip Global Traffic Manager>=13.1.3.4<13.1.3.6

F5 Big-ip Global Traffic Manager=12.1.5.2

F5 Big-ip Link Controller>=13.1.3.4<13.1.3.6

F5 Big-ip Link Controller=12.1.5.2

F5 Big-ip Local Traffic Manager>=13.1.3.4<13.1.3.6

F5 Big-ip Local Traffic Manager=12.1.5.2

F5 Big-ip Policy Enforcement Manager>=13.1.3.4<13.1.3.6

F5 Big-ip Policy Enforcement Manager=12.1.5.2

F5 SSL Orchestrator>=13.1.3.4<13.1.3.6

F5 SSL Orchestrator=12.1.5.2

Event History

Mar 31, 2021

CVE Published

via MITRE·05:26 PM

Data Sourced

via MITRE·05:26 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-23000?

CVE-2021-23000 is a vulnerability that affects F5 BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, allowing malicious requests to cause a denial of service (DoS) condition.

Which F5 products are affected by CVE-2021-23000?

CVE-2021-23000 affects F5 BIG-IP Access Policy Manager, F5 BIG-IP Advanced Firewall Manager, F5 Big-ip Advanced Web Application Firewall, F5 BIG-IP Analytics, F5 Big-ip Application Acceleration Manager, F5 BIG-IP Application Security Manager, F5 Big-ip Ddos Hybrid Defender, F5 Big-ip Domain Name System, F5 Big-ip Fraud Protection Service, F5 Big-ip Global Traffic Manager, F5 Big-ip Link Controller, F5 Big-ip Local Traffic Manager, F5 Big-ip Policy Enforcement Manager, and F5 SSL Orchestrator.

What is the severity of CVE-2021-23000?