CVE-2022-27182: Medium severity F5 BIG-IP Access Policy Manager vulnerability
Published May 5, 2022
·Updated
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual server is configured with the type set to Reject, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected Software
143 affected components
F5 BIG-IP Access Policy Manager=14.1.0
F5 BIG-IP Access Policy Manager=14.1.2
F5 BIG-IP Access Policy Manager=14.1.3
F5 BIG-IP Access Policy Manager=14.1.4
F5 BIG-IP Access Policy Manager=15.1.0
F5 BIG-IP Access Policy Manager=15.1.1
F5 BIG-IP Access Policy Manager=15.1.2
F5 BIG-IP Access Policy Manager=15.1.3
F5 BIG-IP Access Policy Manager=15.1.4
F5 BIG-IP Access Policy Manager=15.1.5
F5 BIG-IP Access Policy Manager=16.1.0
F5 BIG-IP Access Policy Manager=16.1.1
F5 BIG-IP Access Policy Manager=16.1.2
F5 BIG-IP Advanced Firewall Manager=14.1.0
F5 BIG-IP Advanced Firewall Manager=14.1.2
F5 BIG-IP Advanced Firewall Manager=14.1.3
F5 BIG-IP Advanced Firewall Manager=14.1.4
F5 BIG-IP Advanced Firewall Manager=15.1.0
F5 BIG-IP Advanced Firewall Manager=15.1.1
F5 BIG-IP Advanced Firewall Manager=15.1.2
F5 BIG-IP Advanced Firewall Manager=15.1.3
F5 BIG-IP Advanced Firewall Manager=15.1.4
F5 BIG-IP Advanced Firewall Manager=15.1.5
F5 BIG-IP Advanced Firewall Manager=16.1.0
F5 BIG-IP Advanced Firewall Manager=16.1.1
F5 BIG-IP Advanced Firewall Manager=16.1.2
F5 BIG-IP Analytics=14.1.0
F5 BIG-IP Analytics=14.1.2
F5 BIG-IP Analytics=14.1.3
F5 BIG-IP Analytics=14.1.4
F5 BIG-IP Analytics=15.1.0
F5 BIG-IP Analytics=15.1.1
F5 BIG-IP Analytics=15.1.2
F5 BIG-IP Analytics=15.1.3
F5 BIG-IP Analytics=15.1.4
F5 BIG-IP Analytics=15.1.5
F5 BIG-IP Analytics=16.1.0
F5 BIG-IP Analytics=16.1.1
F5 BIG-IP Analytics=16.1.2
F5 Big-ip Application Acceleration Manager=14.1.0
F5 Big-ip Application Acceleration Manager=14.1.2
F5 Big-ip Application Acceleration Manager=14.1.3
F5 Big-ip Application Acceleration Manager=14.1.4
F5 Big-ip Application Acceleration Manager=15.1.0
F5 Big-ip Application Acceleration Manager=15.1.1
F5 Big-ip Application Acceleration Manager=15.1.2
F5 Big-ip Application Acceleration Manager=15.1.3
F5 Big-ip Application Acceleration Manager=15.1.4
F5 Big-ip Application Acceleration Manager=15.1.5
F5 Big-ip Application Acceleration Manager=16.1.0
F5 Big-ip Application Acceleration Manager=16.1.1
F5 Big-ip Application Acceleration Manager=16.1.2
F5 BIG-IP Application Security Manager=14.1.0
F5 BIG-IP Application Security Manager=14.1.2
F5 BIG-IP Application Security Manager=14.1.3
F5 BIG-IP Application Security Manager=14.1.4
F5 BIG-IP Application Security Manager=15.1.0
F5 BIG-IP Application Security Manager=15.1.1
F5 BIG-IP Application Security Manager=15.1.2
F5 BIG-IP Application Security Manager=15.1.3
F5 BIG-IP Application Security Manager=15.1.4
F5 BIG-IP Application Security Manager=15.1.5
F5 BIG-IP Application Security Manager=16.1.0
F5 BIG-IP Application Security Manager=16.1.1
F5 BIG-IP Application Security Manager=16.1.2
F5 Big-ip Domain Name System=14.1.0
F5 Big-ip Domain Name System=14.1.2
F5 Big-ip Domain Name System=14.1.3
F5 Big-ip Domain Name System=14.1.4
F5 Big-ip Domain Name System=15.1.0
F5 Big-ip Domain Name System=15.1.1
F5 Big-ip Domain Name System=15.1.2
F5 Big-ip Domain Name System=15.1.3
F5 Big-ip Domain Name System=15.1.4
F5 Big-ip Domain Name System=15.1.5
F5 Big-ip Domain Name System=16.1.0
F5 Big-ip Domain Name System=16.1.1
F5 Big-ip Domain Name System=16.1.2
F5 Big-ip Fraud Protection Service=14.1.0
F5 Big-ip Fraud Protection Service=14.1.2
F5 Big-ip Fraud Protection Service=14.1.3
F5 Big-ip Fraud Protection Service=14.1.4
F5 Big-ip Fraud Protection Service=15.1.0
F5 Big-ip Fraud Protection Service=15.1.1
F5 Big-ip Fraud Protection Service=15.1.2
F5 Big-ip Fraud Protection Service=15.1.3
F5 Big-ip Fraud Protection Service=15.1.4
F5 Big-ip Fraud Protection Service=15.1.5
F5 Big-ip Fraud Protection Service=16.1.0
F5 Big-ip Fraud Protection Service=16.1.1
F5 Big-ip Fraud Protection Service=16.1.2
F5 Big-ip Global Traffic Manager=14.1.0
F5 Big-ip Global Traffic Manager=14.1.2
F5 Big-ip Global Traffic Manager=14.1.3
F5 Big-ip Global Traffic Manager=14.1.4
F5 Big-ip Global Traffic Manager=15.1.0
F5 Big-ip Global Traffic Manager=15.1.1
F5 Big-ip Global Traffic Manager=15.1.2
F5 Big-ip Global Traffic Manager=15.1.3
F5 Big-ip Global Traffic Manager=15.1.4
F5 Big-ip Global Traffic Manager=15.1.5
F5 Big-ip Global Traffic Manager=16.1.0
F5 Big-ip Global Traffic Manager=16.1.1
F5 Big-ip Global Traffic Manager=16.1.2
F5 Big-ip Link Controller=14.1.0
F5 Big-ip Link Controller=14.1.2
F5 Big-ip Link Controller=14.1.3
F5 Big-ip Link Controller=14.1.4
F5 Big-ip Link Controller=15.1.0
F5 Big-ip Link Controller=15.1.1
F5 Big-ip Link Controller=15.1.2
F5 Big-ip Link Controller=15.1.3
F5 Big-ip Link Controller=15.1.4
F5 Big-ip Link Controller=15.1.5
F5 Big-ip Link Controller=16.1.0
F5 Big-ip Link Controller=16.1.1
F5 Big-ip Link Controller=16.1.2
F5 Big-ip Local Traffic Manager=14.1.0
F5 Big-ip Local Traffic Manager=14.1.2
F5 Big-ip Local Traffic Manager=14.1.3
F5 Big-ip Local Traffic Manager=14.1.4
F5 Big-ip Local Traffic Manager=15.1.0
F5 Big-ip Local Traffic Manager=15.1.1
F5 Big-ip Local Traffic Manager=15.1.2
F5 Big-ip Local Traffic Manager=15.1.3
F5 Big-ip Local Traffic Manager=15.1.4
F5 Big-ip Local Traffic Manager=15.1.5
F5 Big-ip Local Traffic Manager=16.1.0
F5 Big-ip Local Traffic Manager=16.1.1
F5 Big-ip Local Traffic Manager=16.1.2
F5 Big-ip Policy Enforcement Manager=14.1.0
F5 Big-ip Policy Enforcement Manager=14.1.2
F5 Big-ip Policy Enforcement Manager=14.1.3
F5 Big-ip Policy Enforcement Manager=14.1.4
F5 Big-ip Policy Enforcement Manager=15.1.0
F5 Big-ip Policy Enforcement Manager=15.1.1
F5 Big-ip Policy Enforcement Manager=15.1.2
F5 Big-ip Policy Enforcement Manager=15.1.3
F5 Big-ip Policy Enforcement Manager=15.1.4
F5 Big-ip Policy Enforcement Manager=15.1.5
F5 Big-ip Policy Enforcement Manager=16.1.0
F5 Big-ip Policy Enforcement Manager=16.1.1
F5 Big-ip Policy Enforcement Manager=16.1.2
Event History
May 5, 2022
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-27182?
The severity of CVE-2022-27182 is rated as medium with a CVSS score of 5.3.
2
Which F5 BIG-IP versions are affected by CVE-2022-27182?
F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6 are affected by CVE-2022-27182.
3
How can I mitigate the vulnerability in CVE-2022-27182?
To mitigate CVE-2022-27182, users should update their F5 BIG-IP software to version 16.1.2.2, 15.1.5.1, or 14.1.4.6 and disable BIG-IP packet filters on virtual servers configured with type set to Reject.