CVE-2022-23020: Null Pointer Dereference
First published: Tue Jan 25 2022(Updated: )
On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Access Policy Manager | >=16.1.0<16.1.2 | |
| F5 BIG-IP Advanced Firewall Manager | >=16.1.0<16.1.2 | |
| F5 BIG-IP Analytics | >=16.1.0<16.1.2 | |
| F5 BIG-IP Application Acceleration Manager | >=16.1.0<16.1.2 | |
| F5 Application Security Manager | >=16.1.0<16.1.2 | |
| F5 BIG-IP | >=16.1.0<16.1.2 | |
| F5 BIG-IP Fraud Protection Service | >=16.1.0<16.1.2 | |
| Riverbed SteelApp Traffic Manager | >=16.1.0<16.1.2 | |
| F5 BIG-IP Link Controller | >=16.1.0<16.1.2 | |
| Riverbed SteelApp Traffic Manager | >=16.1.0<16.1.2 | |
| F5 BIG-IP Policy Enforcement Manager | >=16.1.0<16.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-23020?
CVE-2022-23020 has a severity rating that can vary based on the environment, but it is recognized as a significant vulnerability affecting F5 BIG-IP systems.
How do I fix CVE-2022-23020?
Fix for CVE-2022-23020 involves upgrading to F5 BIG-IP versions 16.1.2 or later where the vulnerability is addressed.
Which F5 BIG-IP versions are affected by CVE-2022-23020?
CVE-2022-23020 affects F5 BIG-IP versions 16.1.0 to 16.1.1 inclusive.
What components of F5 BIG-IP are vulnerable in CVE-2022-23020?
The vulnerable components include BIG-IP Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, DNS, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, and Policy Enforcement Manager.
What impact does CVE-2022-23020 have on F5 BIG-IP systems?
CVE-2022-23020 can lead to the termination of the Traffic Management Microkernel (TMM) due to undisclosed requests when the 'Respond on Error' setting is enabled.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/f5
- canonical/f5 access policy manager
- version/f5 access policy manager/16.1.0
- canonical/f5 big-ip advanced firewall manager
- version/f5 big-ip advanced firewall manager/16.1.0
- canonical/f5 big-ip analytics
- version/f5 big-ip analytics/16.1.0
- canonical/f5 big-ip application acceleration manager
- version/f5 big-ip application acceleration manager/16.1.0
- canonical/f5 application security manager
- version/f5 application security manager/16.1.0
- canonical/f5 big-ip
- version/f5 big-ip/16.1.0
- canonical/f5 big-ip fraud protection service
- version/f5 big-ip fraud protection service/16.1.0
- canonical/riverbed steelapp traffic manager
- version/riverbed steelapp traffic manager/16.1.0
- canonical/f5 big-ip link controller
- version/f5 big-ip link controller/16.1.0
- canonical/f5 big-ip policy enforcement manager
- version/f5 big-ip policy enforcement manager/16.1.0