CVE-2022-23015: High severity f5 access policy manager vulnerability
On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23015?
The severity of CVE-2022-23015 is classified as high due to the potential for increased resource consumption on affected systems.
How do I fix CVE-2022-23015?
To fix CVE-2022-23015, upgrade to BIG-IP versions 16.1.0 or later, 15.1.4.1 or later, or 14.1.4.4 or later.
What software is affected by CVE-2022-23015?
CVE-2022-23015 affects F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, and several other BIG-IP components.
Is CVE-2022-23015 capable of remote exploitation?
Yes, CVE-2022-23015 can be exploited remotely if the affected software is configured with Client SSL profiles and certain security settings.
What is the impact of not addressing CVE-2022-23015?
Failure to address CVE-2022-23015 can lead to increased resource consumption, potentially impacting system performance and availability.