CVE-2021-23009: High severity F5 BIG-IP Access Policy Manager vulnerability

Q: What is CVE-2021-23009?

CVE-2021-23009 is a vulnerability in the BIG-IP software that allows for a Denial of Service attack through malformed HTTP/2 requests.

Q: Which versions of BIG-IP are affected by CVE-2021-23009?

Versions 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3 are affected by CVE-2021-23009.

Q: What is the severity of CVE-2021-23009?

CVE-2021-23009 has a severity rating of 7.5, which is considered high.

Q: How does CVE-2021-23009 impact the system?

CVE-2021-23009 can cause an infinite loop in the system, leading to a Denial of Service for Data Plane traffic.

Q: How can I fix CVE-2021-23009?

To fix CVE-2021-23009, you should update your BIG-IP software to version 16.0.1.1 or 15.1.3, depending on your current version.

Published May 10, 2021

Updated

On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

28 affected components

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.3

F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1.1

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.3

F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1.1

F5 Big-ip Advanced Web Application Firewall>=15.1.0<15.1.3

F5 Big-ip Advanced Web Application Firewall>=16.0.0<16.0.1.1

F5 BIG-IP Analytics>=15.1.0<15.1.3

F5 BIG-IP Analytics>=16.0.0<16.0.1.1

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.3

F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1.1

F5 BIG-IP Application Security Manager>=15.1.0<15.1.3

F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.1

F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.3

F5 Big-ip Ddos Hybrid Defender>=16.0.0<16.0.1.1

F5 Big-ip Domain Name System>=15.1.0<15.1.3

F5 Big-ip Domain Name System>=16.0.0<16.0.1.1

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.3

F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1.1

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.3

F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Link Controller>=15.1.0<15.1.3

F5 Big-ip Link Controller>=16.0.0<16.0.1.1

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.3

F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.3

F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1.1

F5 BIG-IP SSL Orchestrator>=15.1.0<15.1.3

F5 BIG-IP SSL Orchestrator>=16.0.0<16.0.1.1

Event History

May 10, 2021

CVE Published

via MITRE·02:18 PM

Data Sourced

via MITRE·02:18 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-23009?

CVE-2021-23009 is a vulnerability in the BIG-IP software that allows for a Denial of Service attack through malformed HTTP/2 requests.

Which versions of BIG-IP are affected by CVE-2021-23009?

Versions 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3 are affected by CVE-2021-23009.

What is the severity of CVE-2021-23009?