CVE-2022-23020: Null Pointer Dereference
On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23020?
CVE-2022-23020 has a severity rating that can vary based on the environment, but it is recognized as a significant vulnerability affecting F5 BIG-IP systems.
How do I fix CVE-2022-23020?
Fix for CVE-2022-23020 involves upgrading to F5 BIG-IP versions 16.1.2 or later where the vulnerability is addressed.
Which F5 BIG-IP versions are affected by CVE-2022-23020?
CVE-2022-23020 affects F5 BIG-IP versions 16.1.0 to 16.1.1 inclusive.
What components of F5 BIG-IP are vulnerable in CVE-2022-23020?
The vulnerable components include BIG-IP Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, DNS, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, and Policy Enforcement Manager.
What impact does CVE-2022-23020 have on F5 BIG-IP systems?
CVE-2022-23020 can lead to the termination of the Traffic Management Microkernel (TMM) due to undisclosed requests when the 'Respond on Error' setting is enabled.